# helm_charts_job-grpc-certs.yaml
{{- if and .Values.grpc .Values.certs.grpc.create }}
{{ $fullname := include "dex.fullname" . }}
{{ $tlsServerBuiltName := printf "%s-server-tls" $fullname }}
{{ $tlsServerSecretName := default $tlsServerBuiltName .Values.certs.grpc.secret.serverTlsName }}
{{ $tlsClientBuiltName := printf "%s-client-tls" $fullname }}
{{ $tlsClientSecretName := default $tlsClientBuiltName .Values.certs.grpc.secret.clientTlsName }}
{{ $caBuiltName := printf "%s-ca" $fullname }}
{{ $caName := default $caBuiltName .Values.certs.grpc.secret.caName }}
{{ $openSslConfigName := printf "%s-openssl-config" $fullname }}
{{ $local := dict "i" 0 }}
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-weight": "2"
    "helm.sh/hook-delete-policy": hook-succeeded
  name: {{ $fullname }}-grpc-certs
  labels:
{{ include "dex.labels" . | indent 4 }}
    app.kubernetes.io/component: "job-grpc-certs"
spec:
  activeDeadlineSeconds: {{ .Values.certs.grpc.activeDeadlineSeconds }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "dex.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: "job-grpc-certs"
{{- if .Values.certs.grpc.pod.annotations }}
      annotations:
{{ toYaml .Values.certs.grpc.pod.annotations | trim | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.certs.securityContext.enabled }}
      securityContext:
        runAsUser: {{ .Values.certs.securityContext.runAsUser }}
        fsGroup: {{ .Values.certs.securityContext.fsGroup }}
      {{- end }}
      serviceAccountName: {{ template "dex.serviceAccountName" . }}
      nodeSelector:
{{ toYaml .Values.certs.grpc.pod.nodeSelector | indent 8 }}
{{- with .Values.certs.grpc.pod.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.certs.grpc.pod.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
{{- end }}
      restartPolicy: OnFailure
      containers:
      - name: main
        image: "{{ .Values.certs.image }}:{{ .Values.certs.imageTag }}"
        imagePullPolicy: {{ .Values.certs.imagePullPolicy }}
        env:
        - name: HOME
          value: /tmp
        workingDir: /tmp
        command:
        - /bin/bash
        - -exc
        - |
          export CONFIG=/etc/dex/tls/grpc/openssl.conf;
          cat << EOF > san.cnf
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.grpc.altNames }}
          DNS.{{ $local.i }}:{{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          {{- $_ := set $local "i" 1 }}
          {{- range .Values.certs.grpc.altIPs }}
          IP.{{ $local.i }}:{{ . }}
          {{- $_ := set $local "i" ( add1 $local.i ) }}
          {{- end }}
          EOF
          export SAN=$(cat san.cnf |  paste -sd "," -)

          # Creating basic files/directories
          mkdir -p {certs,crl,newcerts}
          touch index.txt
          touch index.txt.attr
          echo 1000 > serial
          # CA private key (unencrypted)
          openssl genrsa -out ca.key 4096;
          # Certificate Authority (self-signed certificate)
          openssl req -config $CONFIG -new -x509 -days 3650 -sha256 -key ca.key -extensions v3_ca -out ca.crt -subj "/CN=grpc-ca";
          # Server private key (unencrypted)
          openssl genrsa -out server.key 2048;
          # Server certificate signing request (CSR)
          openssl req -config $CONFIG -new -sha256 -key server.key -out server.csr -subj "/CN=grpc-server";
          # Certificate Authority signs CSR to grant a certificate
          openssl ca -batch -config $CONFIG  -extensions server_cert -days 365 -notext -md sha256 -in server.csr -out server.crt -cert ca.crt -keyfile ca.key;
          # Client private key (unencrypted)
          openssl genrsa -out client.key 2048;
          # Signed client certificate signing request (CSR)
          openssl req -config $CONFIG -new -sha256 -key client.key -out client.csr -subj "/CN=grpc-client";
          # Certificate Authority signs CSR to grant a certificate
          openssl ca -batch -config $CONFIG -extensions usr_cert -days 365 -notext -md sha256 -in client.csr -out client.crt -cert ca.crt -keyfile ca.key;
          # Remove CSR's
          rm *.csr;

          # Cleanup the existing configmap and secrets
          kubectl delete configmap {{ $caName }} --namespace {{ .Release.Namespace }} || true
          kubectl delete secret {{ $caName }} {{ $tlsServerSecretName }} {{ $tlsClientSecretName }} --namespace {{ .Release.Namespace }} || true
          kubectl create configmap {{ $caName }} --namespace {{ .Release.Namespace }} --from-file=ca.crt;
          # Store all certficates in secrets
          kubectl create secret tls {{ $caName }} --namespace {{ .Release.Namespace }} --cert=ca.crt --key=ca.key;
          kubectl create secret tls {{ $tlsServerSecretName }} --namespace {{ .Release.Namespace }} --cert=server.crt --key=server.key;
          kubectl create secret tls {{ $tlsClientSecretName }} --namespace {{ .Release.Namespace }} --cert=client.crt --key=client.key;
        volumeMounts:
        - name: openssl-config
          mountPath: /etc/dex/tls/grpc
      volumes:
      - name: openssl-config
        configMap:
          name: {{ $openSslConfigName }}
{{- end }}