{{- if .Values.preinstallHook }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "rancher.fullname" . }}-create-tls-ca-job
  labels: {{ include "rancher.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "2" # Certificate 생성 후 실행되도록 우선순위 설정
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
spec:
  backoffLimit: 4
  template:
    spec:
      serviceAccountName: {{ template "rancher.fullname" . }}-create-tls-ca-sa
      containers:
        - name: create-secret
          image: bitnami/kubectl:latest
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -c
            - |
              echo "Waiting for {{ .Values.ingress.tls.secretName }} to be created..."
              while [ $(kubectl get secret {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }} --ignore-not-found | wc -l) -lt 2 ]; do
                sleep 1
              done
              echo "Creating new secret with custom key..."
              RANCHER_CA_CERT=$(kubectl get secret {{ .Values.ingress.tls.secretName }}  -o jsonpath='{.data.ca\.crt}' -n {{ .Release.Namespace }} | base64 -d)
              kubectl create secret generic tls-ca --from-literal=cacerts\.pem="${RANCHER_CA_CERT}" -n {{ .Release.Namespace }}
      restartPolicy: OnFailure
{{- end }}