#!/usr/bin/env bash
# cert-manager plus a self-signed cluster issuer (offline local CA).
# Notes: docs/notes/addons.md
set -euo pipefail
cd "$(dirname "$0")/.."

source ./lib/config.sh
load_config

K="kubectl --context ${KUBECONTEXT}"

if $K get deployment -n cert-manager cert-manager >/dev/null 2>&1; then
    echo "  already installed"
else
    $K apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
fi

echo "  waiting for cert-manager..."
$K wait --namespace cert-manager \
    --for=condition=ready pod --selector=app.kubernetes.io/instance=cert-manager \
    --timeout=240s

# A self-signed root, then a CA issuer chained off it. Workloads reference
# ClusterIssuer/local-ca and get a cert from a CA you can actually distribute.
echo "  creating local CA issuer"
$K apply -f - <<'YAML' >/dev/null
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-root
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: local-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: rig-local-ca
  secretName: local-ca-key-pair
  duration: 87600h
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: selfsigned-root
    kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: local-ca
spec:
  ca:
    secretName: local-ca-key-pair
YAML

echo "  export the CA for your browser/client with:"
echo "    kubectl --context ${KUBECONTEXT} -n cert-manager get secret local-ca-key-pair -o jsonpath='{.data.tls\\.crt}' | base64 -d"