{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "certmanager") (not .Values.clustermesh.apiserver.tls.auto.certManagerIssuerRef) }}
{{- $_ := include "clustermesh-apiserver-generate-certs.helm.setup-ca" . -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: clustermesh-apiserver-ca-cert
  namespace: {{ .Release.Namespace }}
data:
  ca.crt: {{ .cmca.Cert | b64enc }}
  ca.key: {{ .cmca.Key  | b64enc }}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: clustermesh-apiserver-issuer
  namespace: {{ .Release.Namespace }}
spec:
  ca:
    secretName: clustermesh-apiserver-ca-cert
{{- end }}
