apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "eg.fullname" . }}-certgen
  namespace: '{{ .Release.Namespace }}'
  labels:
  {{- include "eg.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-install, pre-upgrade
  {{- if .Values.certgen.job.annotations }}
    {{- toYaml .Values.certgen.job.annotations | nindent 4 -}}
  {{- end }}
spec:
  backoffLimit: 1
  completions: 1
  parallelism: 1
  template:
    metadata:
      labels:
        app: certgen
        {{- if .Values.certgen.job.pod.labels }}
          {{- toYaml .Values.certgen.job.pod.labels | nindent 8 -}}
        {{- end }}
      {{- if .Values.certgen.job.pod.annotations }}
      annotations:
        {{- toYaml .Values.certgen.job.pod.annotations | nindent 8 -}}
      {{- end }}
    spec:
      containers:
      {{- $args := .Values.certgen.job.args }}
      {{- if not .Values.topologyInjector.enabled }}
        {{- $args = append $args "--disable-topology-injector" }}
      {{- end }}
      {{- if $args }}
      - args:
        {{- toYaml $args | nindent 8 }}
        command:
        - envoy-gateway
        - certgen
      {{- else }}
      - command:
        - envoy-gateway
        - certgen
      {{- end }}
        env:
        - name: ENVOY_GATEWAY_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: KUBERNETES_CLUSTER_DOMAIN
          value: {{ .Values.kubernetesClusterDomain }}
        image: {{ include "eg.image" . }}
        imagePullPolicy: {{ include "eg.image.pullPolicy" . }}
        name: envoy-gateway-certgen
        {{- with .Values.certgen.job.resources }}
        resources:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        securityContext:
          {{- toYaml .Values.certgen.job.securityContext | nindent 10 }}
      {{- include "eg.image.pullSecrets" . | nindent 6 }}
      {{- with .Values.certgen.job.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.certgen.job.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.certgen.job.tolerations }}
      tolerations:
        {{- toYaml . | nindent 6 }}
      {{- end }}
      restartPolicy: Never
      serviceAccountName: {{ include "eg.fullname" . }}-certgen
  {{- if not ( kindIs "invalid" .Values.certgen.job.ttlSecondsAfterFinished) }}
  ttlSecondsAfterFinished: {{ .Values.certgen.job.ttlSecondsAfterFinished }}
  {{- end }}