########################################
## SHARED | deploykf
########################################
deployKF:
  extraManifests:
    {{<- range $manifest := .Values.deploykf_dependencies.cert_manager.extraManifests >}}
    - {{< (tpl $manifest $) | quote >}}
    {{<- end >}}

  certManager:
    clusterIssuer:
      enabled: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.enabled | conv.ToBool >}}
      issuerName: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.issuerName | quote >}}
      type: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.type | quote >}}
      selfSigned:
        caIssuerName: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.selfSigned.caIssuerName | quote >}}
        caSecretName: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.selfSigned.caSecretName | quote >}}
        injectedConfigMapName: {{< .Values.deploykf_dependencies.cert_manager.clusterIssuer.selfSigned.injectedConfigMapName | quote >}}


########################################
## DEPENDENCY | cert-manager
########################################
## as we reference the "cert-manager" chart (https://charts.jetstack.io) in `dependencies` of Chart.yaml,
## we must indent our values under `cert-manager:` in this file
cert-manager:
  fullnameOverride: cert-manager

  installCRDs: true

  replicaCount: 1

  image:
    repository: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerController.repository | quote >}}
    {{<- if .Values.deploykf_dependencies.cert_manager.images.certManagerController.tag >}}
    tag: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerController.tag | quote >}}
    {{<- end >}}
    pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerController.pullPolicy | quote >}}

  podLabels: {{< .Values.deploykf_dependencies.cert_manager.controller.podLabels | toJSON >}}

  securityContext: {{< .Values.deploykf_dependencies.cert_manager.controller.securityContext | toJSON >}}

  serviceAccount:
    create: {{< .Values.deploykf_dependencies.cert_manager.controller.serviceAccount.create | conv.ToBool >}}
    name: {{< .Values.deploykf_dependencies.cert_manager.controller.serviceAccount.name | quote >}}
    annotations: {{< .Values.deploykf_dependencies.cert_manager.controller.serviceAccount.annotations | toJSON >}}

  extraArgs: {{< .Values.deploykf_dependencies.cert_manager.controller.extraArgs | toJSON >}}

  prometheus:
    enabled: false

  webhook:
    replicaCount: 1
    image:
      repository: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerWebhook.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.cert_manager.images.certManagerWebhook.tag >}}
      tag: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerWebhook.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerWebhook.pullPolicy | quote >}}

    {{<- if .Values.kubernetes.azure.admissionsEnforcerFix >}}
    ## azure aks admissions enforcer fix
    ## https://github.com/cert-manager/cert-manager/issues/4114
    validatingWebhookConfigurationAnnotations:
      "admissions.enforcer/disabled": "true"
    mutatingWebhookConfigurationAnnotations:
      "admissions.enforcer/disabled": "true"
    {{<- end >}}

  cainjector:
    enabled: true
    replicaCount: 1
    image:
      repository: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCainjector.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.cert_manager.images.certManagerCainjector.tag >}}
      tag: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCainjector.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCainjector.pullPolicy | quote >}}

  acmesolver:
    image:
      repository: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerAcmesolver.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.cert_manager.images.certManagerAcmesolver.tag >}}
      tag: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerAcmesolver.tag | quote >}}
      {{<- end >}}

  startupapicheck:
    enabled: true
    image:
      repository: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCtl.repository | quote >}}
      {{<- if .Values.deploykf_dependencies.cert_manager.images.certManagerCtl.tag >}}
      tag: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCtl.tag | quote >}}
      {{<- end >}}
      pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.certManagerCtl.pullPolicy | quote >}}

    jobAnnotations:
      ## this job will block the main sync wave until the webhook is ready to create certificates,
      ## by default this hook would run PostSync (helm: post-install), which is too late
      argocd.argoproj.io/hook: Sync
      argocd.argoproj.io/sync-wave: "1"
      argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation

    rbac:
      annotations:
        ## we ensure the RBAC resources have earlier sync-wave than the job
        argocd.argoproj.io/hook: Sync
        argocd.argoproj.io/sync-wave: "0"
        argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation

    serviceAccount:
      annotations:
        ## we ensure the ServiceAccount resources have earlier sync-wave than the job
        argocd.argoproj.io/hook: Sync
        argocd.argoproj.io/sync-wave: "0"
        argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation


########################################
## DEPENDENCY | trust-manager
########################################
## as we reference the "trust-manager" chart (https://charts.jetstack.io) in `dependencies` of Chart.yaml,
## we must indent our values under `trust-manager:` in this file
trust-manager:
  replicaCount: 1

  image:
    repository: {{< .Values.deploykf_dependencies.cert_manager.images.trustManager.repository | quote >}}
    {{<- if .Values.deploykf_dependencies.cert_manager.images.trustManager.tag >}}
    tag: {{< .Values.deploykf_dependencies.cert_manager.images.trustManager.tag | quote >}}
    {{<- end >}}
    pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.trustManager.pullPolicy | quote >}}

  defaultPackageImage:
    repository: {{< .Values.deploykf_dependencies.cert_manager.images.trustManagerDefaultPackage.repository | quote >}}
    {{<- if .Values.deploykf_dependencies.cert_manager.images.trustManagerDefaultPackage.tag >}}
    tag: {{< .Values.deploykf_dependencies.cert_manager.images.trustManagerDefaultPackage.tag | quote >}}
    {{<- end >}}
    pullPolicy: {{< .Values.deploykf_dependencies.cert_manager.images.trustManagerDefaultPackage.pullPolicy | quote >}}

  app:
    certificateAnnotations:
      ## we must sync cert-manager resources after cert-manager itself
      argocd.argoproj.io/sync-wave: "10"

    deploymentAnnotations:
      ## we must sync the trust-manager deployment after its certificate is ready
      argocd.argoproj.io/sync-wave: "20"

    trust:
      namespace: {{< .Values.deploykf_dependencies.cert_manager.namespace | quote >}}

    {{<- if .Values.kubernetes.azure.admissionsEnforcerFix >}}
    ## azure aks admissions enforcer fix
    webhook:
      validatingWebhookConfigurationAnnotations:
        "admissions.enforcer/disabled": "true"
    {{<- end >}}