{% if taskserv.mtls.enabled and taskserv.mtls.cert_manager.enabled %}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ taskserv.mtls.ca_secret }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.deployment }}
    app.kubernetes.io/managed-by: provisioning
    app.kubernetes.io/component: buildkit-mtls-ca
spec:
  isCA: true
  commonName: {{ taskserv.mtls.cert_manager.ca_common_name }}
  secretName: {{ taskserv.mtls.ca_secret }}
  duration: {{ taskserv.mtls.cert_manager.ca_duration }}
  renewBefore: {{ taskserv.mtls.cert_manager.ca_renew_before }}
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: {{ taskserv.mtls.cert_manager.cluster_issuer_name }}
    kind: ClusterIssuer
    group: cert-manager.io
{% endif %}