{{- if .Values.createSelfSignedCert }}
{{- $ca := .ca | default (genCA (printf "*.%s.svc" .Release.Namespace) 1024) -}}
{{- $cert := genSignedCert (printf "%s.%s.svc" (include "kyverno.serviceName" .) .Release.Namespace) nil nil 1024 $ca -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kyverno.serviceName" . }}.{{ .Release.Namespace }}.svc.kyverno-tls-ca
  labels: {{ include "kyverno.labels" . | nindent 4 }}
data:
  rootCA.crt: {{ $ca.Cert | b64enc }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "kyverno.serviceName" . }}.{{ .Release.Namespace }}.svc.kyverno-tls-pair
  labels: {{ include "kyverno.labels" . | nindent 4 }}
  annotations:
    self-signed-cert: "true"
type: kubernetes.io/tls
data:
  tls.key: {{ $cert.Key | b64enc }}
  tls.crt: {{ $cert.Cert | b64enc }}
{{- end -}}
