#imagePullSecrets: []
ejbca:
  env:
    TLS_SETUP_ENABLED: "later"
    LOG_AUDIT_TO_DB: true
  envFrom:
    - secretRef:
        name: configdump-secrets
  configdumpImport:
    enabled: true
    initialize: true
    configMapName: ejbca-ca-init-configmap
    configMapKey: configdump.json
  # More convenient way to integrate with HSM will be available soon
  # Extra init containers to be added to the deployment
  initContainers:
    - name: hsm-driver-init
      image: registry.primekey.com/primekey/hsm-driver-utimaco:4.51.0.1-legacy
      imagePullPolicy: Never
      command:
        [
          "sh",
          "-c",
          "cp --preserve --recursive /opt/keyfactor/p11proxy-client/* /mnt/driver/",
        ]
      volumeMounts:
        - name: p11proxy-client
          mountPath: /mnt/driver/
        # - name: tokens
        #   mountPath: /mnt/tokens
  # Extra sidecar containers to be added to the deployment
  sidecarContainers:
    - name: hsm
      image: registry.primekey.com/primekey/hsm-driver-utimaco:4.51.0.1-legacy
      imagePullPolicy: Never
      volumeMounts:
        - name: cs-pkcs11-r3-cfg
          mountPath: /opt/utimaco/cs_pkcs11_R3.cfg
          subPath: cs_pkcs11_R3.cfg
  # Extra volumes to be added to the deployment
  volumes:
    - name: p11proxy-client
      emptyDir: {}
    - name: after-deployed-pre
      configMap:
        name: ejbca-ca-init-configmap
        defaultMode: 0777
        items:
          - key: "after-deployed-pre.sh"
            path: "after-deployed-pre.sh"
    - name: cs-pkcs11-r3-cfg
      configMap:
        name: ejbca-ca-init-configmap
        items:
          - key: "cs_pkcs11_R3.cfg"
            path: "cs_pkcs11_R3.cfg"
  # Extra volume mounts to be added to the deployment
  volumeMounts:
    - name: p11proxy-client
      mountPath: /opt/keyfactor/p11proxy-client
    - name: after-deployed-pre
      mountPath: /opt/keyfactor/bin/internal/after-deployed-pre.sh
      subPath: after-deployed-pre.sh
# needed to make softhsm volume mount to work
podSecurityContext:
  fsGroup: 10001
ingress:
  enabled: true
  className: "nginx"
  annotations:
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional_no_ca"
    #nginx.ingress.kubernetes.io/auth-tls-secret: "playground/ejbca-ingress-trust-secret"
    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
  hosts:
    - host: "ejbcaca1.testdomain.se"
      paths:
        - path: /
          pathType: Prefix
  # tls:
  #   - hosts:
  #       - "ejbcaca1.testdomain.se"
  #     secretName: ingress-credential-secret-ca
