image:
  repository: keyfactor.jfrog.io/dev-oci/ejbca/ejbca/images/ejbca-ee
  tag: 9.2.0
  pullPolicy: IfNotPresent
imagePullSecrets: [{ name: keyfactor-registry }]
replicaCount: 1
##############################################################################################
ejbca:
  configdumpImport: ####
    enabled: true
    initialize: true
    configMapName: ejbca-ca-init-configmap
    configMapKey: configdump.json
  env:
    LOG_AUDIT_TO_DB: true
    DATABASE_JDBC_URL: "jdbc:mariadb://ejbca-ca-database-mariadb-galera:3306/ejbca?characterEncoding=utf8"
  envFrom:
    - secretRef:
        name: ejbca-db-credentials
    - secretRef:
        name: configdump-secrets
##############################################################################################
  # Extra init containers to be added to the deployment
  initContainers:
    - name: hsm-driver-init
      image: keyfactor.jfrog.io/dev-oci/keyfactor-commons/hsm-driver-softhsm/images/hsm-driver-softhsm:1.1.0
      command:
        ["sh", "-c", "cp --preserve --recursive /opt/keyfactor/p11proxy-client/* /mnt/driver/"]
      volumeMounts:
        - name: p11proxy-client
          mountPath: /mnt/driver/
  # Extra sidecar containers to be added to the deployment
  sidecarContainers:
    - name: hsm
      image: keyfactor.jfrog.io/dev-oci/keyfactor-commons/hsm-driver-softhsm/images/hsm-driver-softhsm:1.1.0
      imagePullPolicy: IfNotPresent
      env:
        - name: SOFTHSM2_LOG_LEVEL
          value: INFO
      volumeMounts:
        - name: tokens
          mountPath: /mnt/tokens
  # Extra volumes to be added to the deployment
  volumes:
    - name: p11proxy-client
      emptyDir: {}
    - name: tokens
      persistentVolumeClaim:
        claimName: softhsm-pvc
    - name: after-init-post
      configMap:
        name: softhsm-slot-init
        defaultMode: 0777
        items:
          - key: "after-init-post.sh"
            path: "after-init-post.sh"
    # signed database entries
    - name: databaseprotection
      secret:
        secretName: ejbca-config-files
        items:
          - key: "databaseprotection.properties"
            path: "databaseprotection.properties"
  # Extra volume mounts to be added to the deployment
  volumeMounts:
    - name: p11proxy-client
      mountPath: /opt/keyfactor/p11proxy-client
    - name: after-init-post
      mountPath: /opt/keyfactor/bin/internal/after-init-post.sh
      subPath: after-init-post.sh
    - name: databaseprotection
      mountPath: /opt/keyfactor/ejbca/conf/databaseprotection.properties
      subPath: databaseprotection.properties
# needed to make softhsm volume mount to work
podSecurityContext:
  fsGroup: 10001
##############################################################################################
resources:
  limits:
    memory: "1Gi"
##############################################################################################
nginx:
  enabled: true
  initializeWithSelfSignedTls: true
  service:
    # Use LoadBalancer to terminate in the pod, otherwise use ClusterIP or NodePort
    type: LoadBalancer
  loadBalancerAccess:
    enableStickySessionClientIp: true
    # create a load balancer service for each Pod with separate IP address
    # enableReplicaSpecificAccess: false
