{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- $releaseNamespace := include "common.names.namespace" . }}
{{- $clusterDomain := .Values.clusterDomain }}
{{- $ca := genCA "thanos-grpc-ca" 365 }}
{{- if and .Values.storegateway.enabled .Values.storegateway.grpc.server.tls.enabled (not .Values.storegateway.grpc.server.tls.existingSecret) }}
{{- $secretName := printf "%s-store-grpc-server" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ include "common.names.namespace" . }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
    app.kubernetes.io/component: storegateway
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
type: Opaque
data:
  {{- if .Values.storegateway.grpc.server.tls.autoGenerated }}
  {{- $hostname := printf "%s-store-grpc-server" (include "common.names.fullname" .) }}
  {{- $cert := genSignedCert $hostname nil (list $hostname) 365 $ca }}
  tls-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-cert" "defaultValue" $cert.Cert "context" $) }}
  tls-key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-key" "defaultValue" $cert.Key "context" $) }}
  ca-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca-cert" "defaultValue" $ca.Cert "context" $) }}
  {{- else }}
  tls-cert: {{ required "'storegateway.grpc.server.tls.cert' is required when 'storegateway.grpc.server.tls.enabled=true'" .Values.storegateway.grpc.server.tls.cert | b64enc | quote }}
  tls-key: {{ required "'storegateway.grpc.server.tls.key' is required when 'storegateway.grpc.server.tls.enabled=true'" .Values.storegateway.grpc.server.tls.key | b64enc | quote }}
  ca-cert: {{ required "'storegateway.grpc.server.tls.ca' is required when 'storegateway.grpc.server.tls.enabled=true'" .Values.storegateway.grpc.server.tls.ca | b64enc | quote }}
  {{- end }}
---
{{- end }}
{{- if and .Values.receive.enabled .Values.receive.grpc.server.tls.enabled (not .Values.receive.grpc.server.tls.existingSecret) }}
{{- $secretName := printf "%s-receive-grpc-server" (include "common.names.fullname" .) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ include "common.names.namespace" . }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
    app.kubernetes.io/component: receive
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
type: Opaque
data:
  {{- if .Values.receive.grpc.server.tls.autoGenerated }}
  {{- $hostname := printf "%s-receive-grpc-server" (include "common.names.fullname" .) }}
  {{- $cert := genSignedCert $hostname nil (list $hostname) 365 $ca }}
  tls-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-cert" "defaultValue" $cert.Cert "context" $) }}
  tls-key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-key" "defaultValue" $cert.Key "context" $) }}
  ca-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca-cert" "defaultValue" $ca.Cert "context" $) }}
  {{- else }}
  tls-cert: {{ required "'receive.grpc.server.tls.cert' is required when 'receive.grpc.server.tls.enabled=true'" .Values.receive.grpc.server.tls.cert | b64enc | quote }}
  tls-key: {{ required "'receive.grpc.server.tls.key' is required when 'receive.grpc.server.tls.enabled=true'" .Values.receive.grpc.server.tls.key | b64enc | quote }}
  ca-cert: {{ required "'receive.grpc.server.tls.ca' is required when 'receive.grpc.server.tls.enabled=true'" .Values.receive.grpc.server.tls.ca | b64enc | quote }}
  {{- end }}
---
{{- end }}
{{- if and .Values.query.enabled .Values.query.grpc.server.tls.enabled (not .Values.query.grpc.server.tls.existingSecret) }}
{{- $secretName := printf "%s-query-grpc-server" (include "common.names.fullname" .) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ include "common.names.namespace" . }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
    app.kubernetes.io/component: query
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
type: Opaque
data:
  {{- if .Values.query.grpc.server.tls.autoGenerated }}
  {{- $hostname := printf "%s-query-grpc-server" (include "common.names.fullname" .) }}
  {{- $cert := genSignedCert $hostname nil (list $hostname) 365 $ca }}
  tls-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-cert" "defaultValue" $cert.Cert "context" $) }}
  tls-key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-key" "defaultValue" $cert.Key "context" $) }}
  ca-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca-cert" "defaultValue" $ca.Cert "context" $) }}
  {{- else }}
  tls-cert: {{ required "'query.grpc.server.tls.cert' is required when 'query.grpc.server.tls=true'" .Values.query.grpc.server.tls.cert | b64enc | quote }}
  tls-key: {{ required "'query.grpc.server.tls.key' is required when 'query.grpc.server.tls=true'" .Values.query.grpc.server.tls.key | b64enc | quote }}
  ca-cert: {{ required "'query.grpc.server.tls.ca' is required when 'query.grpc.server.tls=true'" .Values.query.grpc.server.tls.ca | b64enc | quote }}
  {{- end }}
---
{{- end }}
{{- if and .Values.query.enabled .Values.query.grpc.client.tls.enabled (not .Values.query.grpc.client.tls.existingSecret) }}
{{- $secretName := printf "%s-query-grpc-client" (include "common.names.fullname" .) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ include "common.names.namespace" . }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
    app.kubernetes.io/component: query
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
type: Opaque
data:
  {{- if .Values.query.grpc.client.tls.autoGenerated }}
  {{- $hostname := printf "%s-query-grpc-client" (include "common.names.fullname" .) }}
  {{- $cert := genSignedCert $hostname nil (list $hostname) 365 $ca }}
  tls-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-cert" "defaultValue" $cert.Cert "context" $) }}
  tls-key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls-key" "defaultValue" $cert.Key "context" $) }}
  ca-cert: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca-cert" "defaultValue" $ca.Cert "context" $) }}
  {{- else }}
  tls-cert: {{ required "'query.grpc.client.tls.cert' is required when 'query.grpc.client.tls=true'" .Values.query.grpc.client.tls.cert | b64enc | quote }}
  tls-key: {{ required "'query.grpc.client.tls.key' is required when 'query.grpc.client.tls=true'" .Values.query.grpc.client.tls.key | b64enc | quote }}
  ca-cert: {{ required "'query.grpc.client.tls.ca' is required when 'query.grpc.client.tls=true'" .Values.query.grpc.client.tls.ca | b64enc | quote }}
  {{- end }}
---
{{- end }}
