{{- if and .Values.hubble.enabled .Values.hubble.tls.enabled .Values.hubble.tls.auto.enabled (eq .Values.hubble.tls.auto.method "helm") .Values.hubble.relay.enabled .Values.hubble.relay.tls.server.enabled }}
{{- $_ := include "hubble-generate-certs.helm.setup-ca" . -}}
{{- $cn := "*.hubble-relay.cilium.io" }}
{{- $ip := .Values.hubble.relay.tls.server.extraIpAddresses }}
{{- $dns := prepend .Values.hubble.relay.tls.server.extraDnsNames $cn }}
{{- $cert := genSignedCert $cn $ip $dns (.Values.hubble.tls.auto.certValidityDuration | int) .ca -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: hubble-relay-server-certs
  namespace: {{ .Release.Namespace }}
  {{- with .Values.hubble.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
type: kubernetes.io/tls
data:
  ca.crt:  {{ .ca.Cert | b64enc }}
  tls.crt: {{ $cert.Cert | b64enc }}
  tls.key: {{ $cert.Key  | b64enc }}
{{- end }}