{% if taskserv.mtls.enabled and taskserv.mtls.cert_manager.enabled %}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ taskserv.mtls.server_cert_secret }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.deployment }}
    app.kubernetes.io/managed-by: provisioning
    app.kubernetes.io/component: buildkit-mtls-server
spec:
  commonName: {{ taskserv.mtls.cert_manager.server_common_name }}
  secretName: {{ taskserv.mtls.server_cert_secret }}
  duration: {{ taskserv.mtls.cert_manager.server_duration }}
  renewBefore: {{ taskserv.mtls.cert_manager.server_renew_before }}
  privateKey:
    algorithm: ECDSA
    size: 256
    rotationPolicy: Always
  usages:
    - server auth
    - digital signature
    - key encipherment
  dnsNames:
{% for dns in taskserv.mtls.cert_manager.server_dns_names %}
    - {{ dns }}
{% endfor %}
{% if taskserv.mtls.cert_manager.server_ip_sans | length > 0 %}
  ipAddresses:
{% for ip in taskserv.mtls.cert_manager.server_ip_sans %}
    - {{ ip }}
{% endfor %}
{% endif %}
  issuerRef:
    name: {{ taskserv.mtls.cert_manager.ca_issuer_name }}
    kind: Issuer
    group: cert-manager.io
{% endif %}