{% if taskserv.csi_driver_enabled %}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager-csi-driver
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: cert-manager-csi-driver
    app.kubernetes.io/managed-by: provisioning
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-csi-driver
  labels:
    app.kubernetes.io/name: cert-manager-csi-driver
    app.kubernetes.io/managed-by: provisioning
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch"]
  - apiGroups: ["cert-manager.io"]
    resources: ["certificaterequests"]
    verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
  - apiGroups: ["cert-manager.io"]
    resources: ["certificaterequests/status"]
    verbs: ["update", "patch"]
  - apiGroups: ["cert-manager.io"]
    resources: ["certificates"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-csi-driver
  labels:
    app.kubernetes.io/name: cert-manager-csi-driver
    app.kubernetes.io/managed-by: provisioning
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-csi-driver
subjects:
  - kind: ServiceAccount
    name: cert-manager-csi-driver
    namespace: {{ taskserv.namespace }}
---
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: csi.cert-manager.io
  labels:
    app.kubernetes.io/name: cert-manager-csi-driver
    app.kubernetes.io/managed-by: provisioning
spec:
  attachRequired: false
  podInfoOnMount: true
  volumeLifecycleModes:
    - Ephemeral
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cert-manager-csi-driver
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: cert-manager-csi-driver
    app.kubernetes.io/managed-by: provisioning
spec:
  selector:
    matchLabels:
      app: cert-manager-csi-driver
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: cert-manager-csi-driver
        app.kubernetes.io/name: cert-manager-csi-driver
        app.kubernetes.io/managed-by: provisioning
    spec:
      serviceAccountName: cert-manager-csi-driver
      hostNetwork: false
      containers:
        - name: node-driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.11.1
          args:
            - --v=5
            - --csi-address=/plugin/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.cert-manager.io/csi.sock
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: plugin-dir
              mountPath: /plugin
            - name: registration-dir
              mountPath: /registration
        - name: csi-driver
          image: quay.io/jetstack/cert-manager-csi-driver:{{ taskserv.csi_driver_version }}
          args:
            - --log-level=1
            - --driver-name=csi.cert-manager.io
            - --node-id=$(NODE_ID)
            - --endpoint=$(CSI_ENDPOINT)
            - --data-root=/csi-data-dir
          env:
            - name: NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: CSI_ENDPOINT
              value: unix://plugin/csi.sock
          securityContext:
            privileged: true
            runAsUser: 0
          volumeMounts:
            - name: plugin-dir
              mountPath: /plugin
            - name: pods-mount-dir
              mountPath: /var/lib/kubelet/pods
              mountPropagation: Bidirectional
            - name: csi-data-dir
              mountPath: /csi-data-dir
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              memory: 64Mi
      volumes:
        - name: plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.cert-manager.io
            type: DirectoryOrCreate
        - name: pods-mount-dir
          hostPath:
            path: /var/lib/kubelet/pods
            type: Directory
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory
        - name: csi-data-dir
          hostPath:
            path: /var/lib/cert-manager-csi
            type: DirectoryOrCreate
{% else %}
# csi_driver_enabled = false — cert-manager CSI driver not installed
{% endif %}