#@ load("@ytt:data", "data")

#@ ns = data.values.application.namespace

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ocis-idp-rsa
  namespace: #@ ns
spec:
  secretName: ocis-idp-rsa
  commonName: ocis-idp
  duration: 87600h
  renewBefore: 720h
  privateKey:
    algorithm: RSA
    size: 4096
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ocis-ldap-ca
  namespace: #@ ns
spec:
  secretName: ocis-ldap-ca-tls
  commonName: ocis-ldap-ca
  isCA: true
  duration: 87600h
  renewBefore: 720h
  privateKey:
    algorithm: RSA
    size: 2048
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer

---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: ocis-ldap-ca
  namespace: #@ ns
spec:
  ca:
    secretName: ocis-ldap-ca-tls

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ocis-ldap-cert
  namespace: #@ ns
spec:
  secretName: ocis-ldap-cert-tls
  commonName: idm
  dnsNames:
    - idm
  duration: 87600h
  renewBefore: 720h
  privateKey:
    algorithm: RSA
    size: 2048
  issuerRef:
    name: ocis-ldap-ca
    kind: Issuer
