# _helpers.tpl
{{/* vim: set filetype=mustache: */}}

{{/*Expand the name of the chart.*/}}
{{- define "pomerium.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*Expand the name of the proxy-service.*/}}
{{- define "pomerium.proxy.name" -}}
{{- default (printf "%s-proxy" .Chart.Name) .Values.proxy.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*Expand the name of the authenticate-service.*/}}
{{- define "pomerium.authenticate.name" -}}
{{- default (printf "%s-authenticate" .Chart.Name) .Values.authenticate.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*Expand the name of the authorize-service.*/}}
{{- define "pomerium.authorize.name" -}}
{{- default (printf "%s-authorize" .Chart.Name) .Values.authorize.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "pomerium.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* Proxy services fully qualified name. Truncated at 63 chars. */}}
{{- define "pomerium.proxy.fullname" -}}
{{- if .Values.proxy.fullnameOverride -}}
{{- .Values.proxy.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-proxy" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-proxy" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* authorize services fully qualified name. Truncated at 63 chars. */}}
{{- define "pomerium.authorize.fullname" -}}
{{- if .Values.authorize.fullnameOverride -}}
{{- .Values.authorize.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-authorize" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-authorize" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* authenticate services fully qualified name. Truncated at 63 chars. */}}
{{- define "pomerium.authenticate.fullname" -}}
{{- if .Values.authenticate.fullnameOverride -}}
{{- .Values.authenticate.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-authenticate" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-authenticate" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*Create chart name and version as used by the chart label.*/}}
{{- define "pomerium.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{- define "pomerium.routestring" -}}
{{- $routes := dict "routes" (list) -}}
{{- range $key, $val := .Values.proxy.routes -}}
{{- $noop := printf "%s=%s" $key $val | append $routes.routes | set $routes "routes" -}}
{{- end -}}
{{- join "," $routes.routes | default "none=none" | quote -}}
{{- end -}}


{{/*
Check if a valid source control provider has been set
Adapted from : https://github.com/helm/charts/blob/master/stable/drone/templates/_provider-envs.yaml
*/}}
{{- define "pomerium.providerOK" -}}
{{- if .Values.authenticate.idp -}}
  {{- if eq .Values.authenticate.idp.clientID "" -}}
  false
  {{- else if eq .Values.authenticate.idp.clientSecret "" -}}
  false
  {{- else if eq .Values.authenticate.idp.clientID "REPLACE_ME" -}}
  false
  {{- else if eq .Values.authenticate.idp.clientSecret "REPLACE_ME" -}}
  false
  {{- else -}}
  true
  {{- end -}}
{{- end -}}
{{- end -}}

{{/* Determine secret name for Authenticate TLS Cert */}}
{{- define "pomerium.authenticate.tlsSecret.name" -}}
{{- if .Values.authenticate.existingTLSSecret -}}
{{- .Values.authenticate.existingTLSSecret | trunc 63 | trimSuffix "-" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- else if .Values.config.existingLegacyTLSSecret -}}
{{ template "pomerium.fullname" . }}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-authenticate-tls" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-authenticate-tls" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* Determine secret name for Authorize TLS Cert */}}
{{- define "pomerium.authorize.tlsSecret.name" -}}
{{- if .Values.authorize.existingTLSSecret -}}
{{- .Values.authorize.existingTLSSecret | trunc 63 | trimSuffix "-" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- else if .Values.config.existingLegacyTLSSecret -}}
{{ template "pomerium.fullname" . }}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-authorize-tls" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-authorize-tls" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* Determine secret name for Proxy TLS Cert */}}
{{- define "pomerium.proxy.tlsSecret.name" -}}
{{- if .Values.proxy.existingTLSSecret -}}
{{- .Values.proxy.existingTLSSecret | trunc 63 | trimSuffix "-" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- else if .Values.config.existingLegacyTLSSecret -}}
{{ template "pomerium.fullname" . }}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-proxy-tls" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-proxy-tls" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/* Set up secret data field names for each service */}}
{{- define "pomerium.proxy.tlsSecret.certName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.crt" "proxy-cert" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}
{{- define "pomerium.proxy.tlsSecret.keyName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.key" "proxy-key" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}

{{- define "pomerium.authenticate.tlsSecret.certName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.crt" "authenticate-cert" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}
{{- define "pomerium.authenticate.tlsSecret.keyName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.key" "authenticate-key" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}

{{- define "pomerium.authorize.tlsSecret.certName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.crt" "authorize-cert" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}
{{- define "pomerium.authorize.tlsSecret.keyName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "tls.key" "authorize-key" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}

{{- define "pomerium.caSecret.name" -}}
{{if .Values.config.existingCASecret }}
{{- .Values.proxy.existingCASecret | trunc 63 | trimSuffix "-" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- else if .Values.config.existingLegacyTLSSecret -}}
{{- template "pomerium.fullname" . -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- printf "%s-ca-tls" .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s-ca-tls" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{- define "pomerium.caSecret.certName" -}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- printf "%s" (ternary "ca.crt" "ca-cert" (empty .Values.config.existingLegacyTLSSecret)) -}}
{{- end -}}


{{/*Expand the FQDN of the forward-auth endpoint.*/}}
{{- define "pomerium.forwardAuth.name" -}}
{{- default (printf "forwardauth.%s" .Values.config.rootDomain ) .Values.forwardAuth.nameOverride -}}
{{- end -}} # authenticate-deployment.yaml
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: authenticate
  name: {{ template "pomerium.authenticate.fullname" . }}
  annotations:
 {{- if .Values.authenticate.deployment.annotations }}
 {{- range $key, $value := .Values.authenticate.deployment.annotations }}
   {{ $key }}: {{ $value | quote }}
 {{- end }}
{{- else if .Values.annotations }}
 {{- range $key, $value := .Values.annotations }}
   {{ $key }}: {{ $value | quote }}
 {{- end }}
{{- end }}
spec:
  replicas: {{ default .Values.replicaCount .Values.authenticate.replicaCount }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      annotations:
        {{- /* policy is already covered by hot-reloading */}}
        checksum/config: {{ print .Values.config.extraOpts | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
      labels:
        app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
        helm.sh/chart: {{ template "pomerium.chart" . }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
{{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
      containers:
      - name: {{ .Chart.Name }}
        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args:
{{- if or .Values.config.existingConfig .Values.config.policy }}
          - --config=/etc/pomerium/config.yaml
{{- end }}
{{- range $key, $value := .Values.extraArgs }}
{{- if $value }}
          - --{{ $key }}={{ $value }}
{{- else }}
          - --{{ $key }}
{{- end }}
{{- end }}
        env:
        - name: SERVICES
          value: authenticate
        - name: AUTHENTICATE_SERVICE_URL
          value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
        - name: COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: cookie-secret
        - name: SHARED_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: shared-secret
        - name: IDP_PROVIDER
          value: {{ .Values.authenticate.idp.provider }}
        - name: IDP_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-client-id
        - name: IDP_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-client-secret
        - name: IDP_PROVIDER_URL
          value: {{ .Values.authenticate.idp.url }}
{{- if .Values.authenticate.idp.serviceAccount }}
        - name: IDP_SERVICE_ACCOUNT
          valueFrom:
            secretKeyRef:
              name:  {{ $secretName }}
              key: idp-service-account
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if .Values.config.existingLegacyTLSSecret }}
        - name: CERTIFICATE
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authenticate.tlsSecret.name" . }}
              key:  {{ template "pomerium.authenticate.tlsSecret.certName" . }}
        - name: CERTIFICATE_KEY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authenticate.tlsSecret.name" . }}
              key:  {{ template "pomerium.authenticate.tlsSecret.keyName" . }}
        - name: CERTIFICATE_AUTHORITY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.caSecret.name" . }}
              key:  {{ template "pomerium.caSecret.certName" . }}
{{- else }}
        - name: CERTIFICATE_FILE
          value: "/pomerium/cert.pem"
        - name: CERTIFICATE_KEY_FILE
          value: "/pomerium/privkey.pem"
        - name: CERTIFICATE_AUTHORITY_FILE
          value: "/pomerium/ca.pem"
{{- end }}
{{- range $name, $value := .Values.extraEnv }}
        - name: {{ $name }}
          value: {{ quote $value }}
{{- end }}
        ports:
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: {{ .Values.metrics.port }}
            name: metrics
            protocol: TCP
        livenessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        readinessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
{{- if or .Values.config.existingConfig .Values.config.policy }}
        - mountPath: /etc/pomerium/
          name: config
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
        - mountPath: /pomerium/cert.pem
          name: service-tls
          subPath: {{ template "pomerium.authenticate.tlsSecret.certName" . }}
        - mountPath: /pomerium/privkey.pem
          name: service-tls
          subPath: {{ template "pomerium.authenticate.tlsSecret.keyName" . }}
        - mountPath: /pomerium/ca.pem
          name: ca-tls
          subPath: {{ template "pomerium.caSecret.certName" . }}
{{- end }}
      volumes:
{{- if or .Values.config.existingConfig .Values.config.policy }}
      - name: config
        configMap:
          name: {{ $configName }}
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
      - name: service-tls
        secret:
          secretName: {{ template "pomerium.authenticate.tlsSecret.name" . }}
      - name: ca-tls
        secret:
          secretName: {{ template "pomerium.caSecret.name" . }}
{{- end }}
{{- if .Values.extraVolumes }}
{{- toYaml .Values.extraVolumes | indent 8 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}
 # authenticate-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "pomerium.authenticate.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: authenticate
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
{{- if or .Values.authenticate.service.annotations .Values.service.annotations }}
  annotations:
  {{- if .Values.authenticate.service.annotations }}
    {{- range $key, $value := .Values.authenticate.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- else if .Values.service.annotations }}
    {{- range $key, $value := .Values.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- end }}
{{- end }}
spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.externalPort }}
      targetPort: https
      protocol: TCP
      name: https
    - name: metrics
      port: {{ .Values.metrics.port }}
      protocol: TCP
      targetPort: metrics
{{- if hasKey .Values.service "nodePort" }}
    nodePort: {{ .Values.service.nodePort }}
{{- end }}
  selector:
    app.kubernetes.io/name: {{ template "pomerium.authenticate.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 # authorize-deployment.yaml
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.authorize.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: authorize
  name: {{ template "pomerium.authorize.fullname" . }}
{{- if or .Values.authorize.deployment.annotations .Values.annotations }}
  annotations:
  {{- if .Values.authorize.deployment.annotations }}
    {{- range $key, $value := .Values.authorize.deployment.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- else if .Values.annotations }}
    {{- range $key, $value := .Values.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- end }}
{{- end }}
spec:
  replicas: {{ default .Values.replicaCount .Values.authorize.replicaCount }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ template "pomerium.authorize.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      annotations:
        {{- /* policy is already covered by hot-reloading */}}
        checksum/config: {{ print .Values.config.extraOpts | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
      labels:
        app.kubernetes.io/name: {{ template "pomerium.authorize.name" . }}
        helm.sh/chart: {{ template "pomerium.chart" . }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
{{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
      containers:
      - name: {{ .Chart.Name }}
        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args:
{{- if or .Values.config.existingConfig .Values.config.policy }}
          - --config=/etc/pomerium/config.yaml
{{- end }}
{{- range $key, $value := .Values.extraArgs }}
{{- if $value }}
          - --{{ $key }}={{ $value }}
{{- else }}
          - --{{ $key }}
{{- end }}
{{- end }}
        env:
        - name: SERVICES
          value: authorize
        - name: SHARED_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: shared-secret
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if .Values.config.existingLegacyTLSSecret }}
        - name: CERTIFICATE
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authorize.tlsSecret.name" . }}
              key:  {{ template "pomerium.authorize.tlsSecret.certName" . }}
        - name: CERTIFICATE_KEY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.authorize.tlsSecret.name" . }}
              key:  {{ template "pomerium.authorize.tlsSecret.keyName" . }}
        - name: CERTIFICATE_AUTHORITY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.caSecret.name" . }}
              key:  {{ template "pomerium.caSecret.certName" . }}
{{- else }}
        - name: CERTIFICATE_FILE
          value: "/pomerium/cert.pem"
        - name: CERTIFICATE_KEY_FILE
          value: "/pomerium/privkey.pem"
        - name: CERTIFICATE_AUTHORITY_FILE
          value: "/pomerium/ca.pem"
{{- end }}
{{- range $name, $value := .Values.extraEnv }}
        - name: {{ $name }}
          value: {{ quote $value }}
{{- end }}
        ports:
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: {{ .Values.metrics.port }}
            name: metrics
            protocol: TCP
        livenessProbe:
          tcpSocket:
            port: https
          initialDelaySeconds: 15
        readinessProbe:
          tcpSocket:
            port: https
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
{{- if or .Values.config.existingConfig .Values.config.policy }}
        - mountPath: /etc/pomerium/
          name: config
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
        - mountPath: /pomerium/cert.pem
          name: service-tls
          subPath: {{ template "pomerium.authorize.tlsSecret.certName" . }}
        - mountPath: /pomerium/privkey.pem
          name: service-tls
          subPath: {{ template "pomerium.authorize.tlsSecret.keyName" . }}
        - mountPath: /pomerium/ca.pem
          name: ca-tls
          subPath: {{ template "pomerium.caSecret.certName" . }}
{{- end }}
      volumes:
{{- if or .Values.config.existingConfig .Values.config.policy }}
      - name: config
        configMap:
          name: {{ $configName }}
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
      - name: service-tls
        secret:
          secretName: {{ template "pomerium.authorize.tlsSecret.name" . }}
      - name: ca-tls
        secret:
          secretName: {{ template "pomerium.caSecret.name" . }}
{{- end }}
{{- if .Values.extraVolumes }}
      volumes:
{{- toYaml .Values.extraVolumes | indent 8 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}
 # authorize-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "pomerium.authorize.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.authorize.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: authorize
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
{{- if or .Values.authorize.service.annotations .Values.service.annotations }}
  annotations:
  {{- if .Values.authorize.service.annotations }}
    {{- range $key, $value := .Values.authorize.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- else if .Values.service.annotations }}
    {{- range $key, $value := .Values.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- end }}
{{- end }}
spec:
{{- if .Values.service.authorize.headless }}
  clusterIP: None
  type: ClusterIP
{{- else }}}
  type: {{ .Values.service.type }}
{{- end }}
  ports:
    - port: {{ .Values.service.externalPort }}
      targetPort: https
      protocol: TCP
      name: https
    - name: metrics
      port: {{ .Values.metrics.port }}
      protocol: TCP
      targetPort: metrics
{{- if hasKey .Values.service "nodePort" }}
    nodePort: {{ .Values.service.nodePort }}
{{- end }}
  selector:
    app.kubernetes.io/name: {{ template "pomerium.authorize.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 # configmap.yaml
{{- if not .Values.config.existingConfig }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "pomerium.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
data:
  config.yaml: |
{{- if and .Values.config.existingPolicy .Values.config.extraOpts }}
{{ fail "Cannot use config.extraOpts with config.existingPolicy" }}
{{- end }}
{{- if and .Values.config.existingPolicy .Values.config.policy }}
{{ fail "Cannot use config.policy with config.existingPolicy" }}
{{- end }}
{{- if .Values.config.extraOpts }}
{{ toYaml .Values.config.extraOpts | indent 4 -}}
{{- end -}}
{{- if .Values.metrics.enabled }}
    metrics_address: :{{ .Values.metrics.port }}
{{- end -}}
{{- if .Values.tracing.enabled }}
    tracing_debug: {{ .Values.tracing.debug }}
    tracing_provider: {{ required "tracing_provider is required for tracing" .Values.tracing.provider }}

{{- if eq .Values.tracing.provider "jaeger" }}
    tracing_jaeger_collector_endpoint: {{ required "collector_endpoint is required for jaeoger tracing" .Values.tracing.jaeger.collector_endpoint }}
    tracing_jaeger_agent_endpoint: {{ required "agent_endpoint is required for jaeger tracing" .Values.tracing.jaeger.agent_endpoint }}
{{- end -}}

{{- end -}}
{{- if .Values.forwardAuth.enabled }}
    forward_auth_url: https://{{ template "pomerium.forwardAuth.name" . }}
{{- end -}}
{{- if .Values.config.policy }}
    policy: 
{{ toYaml .Values.config.policy | indent 6 }}
{{- end -}}
{{- end }}
 # ingress.yaml
{{- if .Values.ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ include "pomerium.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ include "pomerium.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    helm.sh/chart: {{ include "pomerium.chart" . }}
{{- with .Values.ingress.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
  tls:
    - secretName: {{ default .Values.ingress.secretName .Values.ingress.secret.name}}
      hosts:
        - {{ printf "authorize.%s" .Values.config.rootDomain | quote }}
        - {{ printf "authenticate.%s" .Values.config.rootDomain | quote }}
        - {{ template "pomerium.forwardAuth.name" . }}
      {{- if not .Values.ingress.hosts }}
      {{- range .Values.config.policy }}
        - {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }}
      {{- end }}
      {{- end }}
      {{- range .Values.ingress.hosts }}
        - {{ . | quote }}
      {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ . | quote }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" $ }}
              servicePort: https
    {{- end }}
    {{- if not (or .Values.ingress.hosts .Values.forwardAuth.enabled) }}
    {{- range .Values.config.policy }}
    - host: {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" $ }}
              servicePort: https
    {{- end }}
    {{- end }}
    {{- if .Values.forwardAuth.enabled }}
    - host: {{ template "pomerium.forwardAuth.name" . }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.proxy.fullname" . }}
              servicePort: https
    {{- end }}
    {{- if not .Values.service.authorize.headless }}
    - host:  {{ printf "authorize.%s" .Values.config.rootDomain }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.authorize.fullname" . }}
              servicePort: https
    {{- end }}
    - host: {{ printf "authenticate.%s" .Values.config.rootDomain }}
      http:
        paths:
          - paths:
            backend:
              serviceName: {{ template "pomerium.authenticate.fullname" . }}
              servicePort: https
{{- end }}
 # proxy-deployment.yaml
{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
{{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.proxy.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: proxy
  name: {{ template "pomerium.proxy.fullname" . }}
{{- if or .Values.proxy.deployment.annotations .Values.annotations }}
  annotations:
  {{- if .Values.proxy.deployment.annotations }}
    {{- range $key, $value := .Values.proxy.deployment.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- else if .Values.annotations }}
    {{- range $key, $value := .Values.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- end }}
{{- end }}
spec:
  replicas: {{ default .Values.replicaCount .Values.proxy.replicaCount }}
  selector:
    matchLabels:  
      app.kubernetes.io/name: {{ template "pomerium.proxy.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      annotations:
        {{- /* policy is already covered by hot-reloading */}}
        checksum/config: {{ print .Values.config.extraOpts | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
{{- if .Values.podAnnotations }}
{{ toYaml .Values.podAnnotations | indent 8 }}
{{- end }}
      labels:
        app.kubernetes.io/name: {{ template "pomerium.proxy.name" . }}
        helm.sh/chart: {{ template "pomerium.chart" . }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8 }}
{{- end }}
    spec:
{{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
{{- end }}
      containers:
      - name: {{ .Chart.Name }}
        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        args:
{{- if or .Values.config.existingConfig .Values.config.policy }}
          - --config=/etc/pomerium/config.yaml
{{- end }}
{{- range $key, $value := .Values.extraArgs }}
{{- if $value }}
          - --{{ $key }}={{ $value }}
{{- else }}
          - --{{ $key }}
{{- end }}
{{- end }}
        env:
        - name: SERVICES
          value: proxy
        - name: COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: cookie-secret
        - name: SHARED_SECRET
          valueFrom:
            secretKeyRef:
              name: {{ $secretName }}
              key: shared-secret
        - name: AUTHENTICATE_SERVICE_URL
          value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
        - name: AUTHORIZE_SERVICE_URL
          value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace ) .Values.proxy.authorizeInternalUrl}}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if .Values.config.existingLegacyTLSSecret }}
        - name: CERTIFICATE
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.proxy.tlsSecret.name" . }}
              key:  {{ template "pomerium.proxy.tlsSecret.certName" . }}
        - name: CERTIFICATE_KEY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.proxy.tlsSecret.name" . }}
              key:  {{ template "pomerium.proxy.tlsSecret.keyName" . }}
        - name: CERTIFICATE_AUTHORITY
          valueFrom:
            secretKeyRef:
              name:  {{ template "pomerium.caSecret.name" . }}
              key:  {{ template "pomerium.caSecret.certName" . }}
{{- else }}
        - name: CERTIFICATE_FILE
          value: "/pomerium/cert.pem"
        - name: CERTIFICATE_KEY_FILE
          value: "/pomerium/privkey.pem"
        - name: CERTIFICATE_AUTHORITY_FILE
          value: "/pomerium/ca.pem"
{{- end }}
{{- range $name, $value := .Values.extraEnv }}
        - name: {{ $name }}
          value: {{ quote $value }}
{{- end }}
        ports:
          - containerPort: 443
            name: https
            protocol: TCP
          - containerPort: {{ .Values.metrics.port }}
            name: metrics
            protocol: TCP
        livenessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        readinessProbe:
          httpGet:
            path: /ping
            port: https
            scheme: HTTPS
        resources:
{{ toYaml .Values.resources | indent 10 }}
        volumeMounts:
{{- if or .Values.config.existingConfig .Values.config.policy }}
        - mountPath: /etc/pomerium/
          name: config
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
        - mountPath: /pomerium/cert.pem
          name: service-tls
          subPath: {{ template "pomerium.proxy.tlsSecret.certName" . }}
        - mountPath: /pomerium/privkey.pem
          name: service-tls
          subPath: {{ template "pomerium.proxy.tlsSecret.keyName" . }}
        - mountPath: /pomerium/ca.pem
          name: ca-tls
          subPath: {{ template "pomerium.caSecret.certName" . }}
{{- end }}
      volumes:
{{- if or .Values.config.existingConfig .Values.config.policy }}
      - name: config
        configMap:
          name: {{ $configName }}
{{- end }}
{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
      - name: service-tls
        secret:
          secretName: {{ template "pomerium.proxy.tlsSecret.name" . }}
      - name: ca-tls
        secret:
          secretName: {{ template "pomerium.caSecret.name" . }}
{{- end }}
{{- if .Values.extraVolumes }}
      volumes:
{{- toYaml .Values.extraVolumes | indent 8 }}
{{- end }}
{{- if .Values.imagePullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.tolerations }}
      tolerations:
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
{{- end }}
 # proxy-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: {{ template "pomerium.proxy.fullname" . }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.proxy.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: proxy
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
{{- if or .Values.proxy.service.annotations .Values.service.annotations }}
  annotations:
  {{- if .Values.proxy.service.annotations }}
    {{- range $key, $value := .Values.proxy.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- else if .Values.service.annotations }}
    {{- range $key, $value := .Values.service.annotations }}
    {{ $key }}: {{ $value | quote }}
    {{- end }}
  {{- end }}
{{- end }}
spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.externalPort }}
      targetPort: https
      protocol: TCP
      name: https
    - name: metrics
      port: {{ .Values.metrics.port }}
      protocol: TCP
      targetPort: metrics
{{- if hasKey .Values.service "nodePort" }}
    nodePort: {{ .Values.service.nodePort }}
{{- end }}
  selector:
    app.kubernetes.io/name: {{ template "pomerium.proxy.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
 # secret.yaml
{{- if not .Values.config.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  name: {{ template "pomerium.fullname" . }}
  namespace: {{ .Release.Namespace }}
type: Opaque
data:
  cookie-secret: {{ default (randAscii 32 | b64enc | b64enc) (.Values.config.cookieSecret | b64enc )}}
  shared-secret: {{ default (randAscii 32 | b64enc | b64enc) (.Values.config.sharedSecret | b64enc )}}
  idp-client-id: {{ .Values.authenticate.idp.clientID | b64enc }}
  idp-client-secret: {{ .Values.authenticate.idp.clientSecret | b64enc }}
{{- if .Values.authenticate.idp.serviceAccount }}
  idp-service-account: {{ .Values.authenticate.idp.serviceAccount | b64enc }}
{{- end }}
{{- end }}

 # servicemonitor.yaml
{{ if .Values.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ template "pomerium.fullname" . }}
{{- if .Values.serviceMonitor.namespace }}
  namespace: {{ .Values.serviceMonitor.namespace }}
{{- end }}
  labels:
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
{{- if .Values.serviceMonitor.labels }}
{{ toYaml .Values.serviceMonitor.labels | indent 4 }}
{{- end }}
spec:
  selector:
    matchLabels:
      helm.sh/chart: {{ template "pomerium.chart" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  endpoints:
  - port: metrics
{{ end }} # tls-secrets.yaml
{{- if .Values.ingress.enabled }}
{{- if not .Values.ingress.secretName }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ default "pomerium-tls" .Values.ingress.secret.name }}
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
type: kubernetes.io/tls
data:
  tls.crt: {{ .Values.ingress.secret.cert }}
  tls.key: {{ .Values.ingress.secret.key }}
---
{{- end }}
{{- end }}

{{- define "pomerium.authenticate.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
  name: {{ template "pomerium.authenticate.tlsSecret.name" . }}
  namespace: {{ .Release.Namespace }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.authorize.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
  name: {{ template "pomerium.authorize.tlsSecret.name" . }}
  namespace: {{ .Release.Namespace }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.proxy.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
  name: {{ template "pomerium.proxy.tlsSecret.name" . }}
  namespace: {{ .Release.Namespace }}
type: kubernetes.io/tls
data:
{{- end -}}

{{- define "pomerium.ca.tlsSecretObject" -}}
apiVersion: v1
kind: Secret
metadata:
  labels:
    app.kubernetes.io/name: {{ template "pomerium.name" . }}
    helm.sh/chart: {{ template "pomerium.chart" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
  annotations:
{{- if .Values.config.forceGenerateTLS }}
    helm.sh/hook: pre-upgrade
{{- else if .Values.config.generateTLS }}
    helm.sh/hook: pre-install
{{- end }}
  name: {{ template "pomerium.caSecret.name" . }}
  namespace: {{ .Release.Namespace }}
type: Opaque
data:
{{- end -}}

{{- /* TODO in future: Remove legacy logic */ -}}
{{- if not .Values.config.existingLegacyTLSSecret }}
{{-   if and .Values.config.generateTLS (or .Release.IsInstall .Values.config.forceGenerateTLS) }}
{{- $ca := genCA "default-ca" 3650 }}
{{- $authenticateSN:= list (printf "authenticate.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}}
{{- $authorizeSN:= list (printf "authorize.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}}
{{- $cn := default "example.com" .Values.config.rootDomain }}
{{ template "pomerium.ca.tlsSecretObject" . }}
  {{ template "pomerium.caSecret.certName" . }}: {{ $ca.Cert | b64enc }}
  ca.key: {{ $ca.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.authenticate.tls.defaultIPList ) ( default $authenticateSN .Values.authenticate.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.authenticate.tlsSecretObject" . }}
  {{ template "pomerium.authenticate.tlsSecret.certName" . }}: {{ $kp.Cert | b64enc }}
  {{ template "pomerium.authenticate.tlsSecret.keyName" . }}: {{ $kp.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.authorize.tls.defaultIPList ) ( default $authorizeSN .Values.authorize.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.authorize.tlsSecretObject" . }}
  {{ template "pomerium.authorize.tlsSecret.certName" . }}: {{ $kp.Cert | b64enc }}
  {{ template "pomerium.authorize.tlsSecret.keyName" . }}: {{ $kp.Key | b64enc }}
---
{{- $kp := genSignedCert $cn ( default nil .Values.proxy.tls.defaultIPList ) ( default nil .Values.proxy.tls.defaultSANList ) 3650 $ca }}
{{ template "pomerium.proxy.tlsSecretObject" . }}
  {{ template "pomerium.proxy.tlsSecret.certName" . }}: {{ $kp.Cert | b64enc }}
  {{ template "pomerium.proxy.tlsSecret.keyName" . }}: {{ $kp.Key | b64enc }}
{{-   else if not .Values.config.generateTLS }}
{{-     if and (not .Values.config.existingCASecret) .Values.config.ca }}
{{ template "pomerium.ca.tlsSecretObject" . }}
  {{ template "pomerium.caSecret.certName" . }}: {{ .Values.config.ca | b64enc }}
{{-     end }}
{{-     if and (not .Values.authenticate.existingTLSSecret) .Values.authenticate.tls.cert .Values.authenticate.tls.key }}
---
{{ template "pomerium.authenticate.tlsSecretObject" . }}
  {{ template "pomerium.authenticate.tlsSecret.certName" . }}: {{ .Values.authenticate.tls.cert | b64enc }}
  {{ template "pomerium.authenticate.tlsSecret.keyName" . }}: {{ .Values.authenticate.tls.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.authorize.existingTLSSecret) .Values.authorize.tls.cert .Values.authorize.tls.key }}
---
{{ template "pomerium.authorize.tlsSecretObject" . }}
  {{ template "pomerium.authorize.tlsSecret.certName" . }}: {{ .Values.authorize.tls.cert | b64enc }}
  {{ template "pomerium.authorize.tlsSecret.keyName" . }}: {{ .Values.authorize.tls.key | b64enc }}
{{-     end }}
{{-     if and (not .Values.proxy.existingTLSSecret) .Values.proxy.tls.cert .Values.proxy.tls.key }}
---
{{ template "pomerium.proxy.tlsSecretObject" . }}
  {{ template "pomerium.proxy.tlsSecret.certName" . }}: {{ .Values.proxy.tls.cert | b64enc }}
  {{ template "pomerium.proxy.tlsSecret.keyName" . }}: {{ .Values.proxy.tls.key | b64enc }}
{{-     end }}
{{-   end }}
{{- end }}

# For detailed explanation of each of the configuration settings see
# https://www.pomerium.io/reference/

nameOverride: ""
fullnameOverride: ""

# settings that are shared by all services
config:
  # routes under this wildcard domain are handled by pomerium
  rootDomain: corp.beyondperimeter.com
  existingSecret: ""
  existingConfig: ""
  existingLegacyTLSSecret: false
  existingCASecret: ""
  sharedSecret: ""
  cookieSecret: ""
  generateTLS: true
  forceGenerateTLS: false
  extraOpts: {}
  existingPolicy: ""
  policy: {}

authenticate:
  fullnameOverride: ""
  nameOverride: ""
  existingTLSSecret: ""
  redirectUrl: ""
  # see https://www.pomerium.io/docs/identity-providers.html
  idp:
    provider: google
    clientID: "REPLACE_ME"
    clientSecret: "REPLACE_ME"
    url: ""
    serviceAccount: ""
  tls:
    cert: ""
    key: ""
    defaultSANList: []
    defaultIPList: []
  replicaCount: 1
  service:
    annotations: {}
  deployment:
    annotations: {}


authorize:
  fullnameOverride: ""
  nameOverride: ""
  existingTLSSecret: ""
  tls:
    cert: ""
    key: ""
    defaultSANList: []
    defaultIPList: []
  replicaCount: 1
  service:
    annotations: {}
  deployment:
    annotations: {}


proxy:
  fullnameOverride: ""
  nameOverride: ""
  existingTLSSecret: ""
  tls:
    cert: ""
    key: ""
    defaultSANList: []
    defaultIPList: []
  replicaCount: 1
  authenticateServiceUrl: ""
  authorizeServiceUrl: ""
  authorizeInternalUrl: ""
  service:
    annotations: {}
  deployment:
    annotations: {}

forwardAuth:
  nameOverride: ""
  enabled: false

service:
  # Service type can be set to ClusterIP, NodePort or LoadBalancer.
  authorize:
    headless: true
  type: ClusterIP
  externalPort: 443
  annotations:
    {}
    # ===  GKE load balancer tweaks; default on until I can figure out
    # how the hell to escape this string from the helm CLI
    # cloud.google.com/app-protocols: '{"https":"HTTPS"}'
  labels: {}

ingress:
  secretName: ""
  secret:
    name: ""
    cert: ""
    key: ""
  enabled: true
  hosts: []
  annotations:
    {}
    # === nginx tweaks
    # kubernetes.io/ingress.class: nginx
    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
    # ===  GKE load balancer tweaks; default on until I can figure out
    # how the hell to escape this string from the helm CLI
    # kubernetes.io/ingress.allow-http: "false"
resources:
  {}
  # limits:
  #   cpu: 100m
  #   memory: 300Mi
  # requests:
  #   cpu: 100m
  #   memory: 300Mi

priorityClassName: ""

# Affinity for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinity: {}

# Tolerations for pod assignment
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

# Node labels for pod assignment
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
nodeSelector: {}

podAnnotations: {}
podLabels: {}
replicaCount: 1

# For any other settings that are optional. for a complete listing see:
# https://www.pomerium.io/docs/config-reference.html
extraEnv: {}
extraArgs: {}
extraVolumes: {}

annotations: {}
imagePullSecrets: ""

image:
  repository: "pomerium/pomerium"
  tag: "v0.5.2"
  pullPolicy: "IfNotPresent"

metrics:
  enabled: false
  port: 9090

tracing:
  enabled: false
  provider: ""
  debug: false
  jaeger:
    collector_endpoint: ""
    agent_endpoint: ""

serviceMonitor:
  enabled: false
  namespace: ""
  labels:
    release: prometheus
