apiVersion: batch/v1
kind: Job
metadata:
  name: hubble-generate-certs
  namespace: kube-system
  labels:
    k8s-app: hubble-generate-certs
    app.kubernetes.io/name: hubble-generate-certs
    app.kubernetes.io/part-of: cilium
  annotations:
    "helm.sh/hook": post-install,post-upgrade
spec:
  template:
    metadata:
      labels:
        k8s-app: hubble-generate-certs
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: certgen
          image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              drop:
                - ALL
            allowPrivilegeEscalation: false
          command:
            - "/usr/bin/cilium-certgen"
          args:
            - "--ca-generate=true"
            - "--ca-reuse-secret"
            - "--ca-secret-namespace=kube-system"
            - "--ca-secret-name=cilium-ca"
            - "--ca-common-name=Cilium CA"
          env:
            - name: CILIUM_CERTGEN_CONFIG
              value: |
                certs:
                - name: hubble-server-certs
                  namespace: kube-system
                  commonName: "*.default.hubble-grpc.cilium.io"
                  hosts:
                  - "*.default.hubble-grpc.cilium.io"
                  usage:
                  - signing
                  - key encipherment
                  - server auth
                  - client auth
                  validity: 8760h
                - name: hubble-relay-client-certs
                  namespace: kube-system
                  commonName: "*.hubble-relay.cilium.io"
                  hosts:
                  - "*.hubble-relay.cilium.io"
                  usage:
                  - signing
                  - key encipherment
                  - client auth
                  validity: 8760h
      hostNetwork: false
      serviceAccount: "hubble-generate-certs"
      serviceAccountName: "hubble-generate-certs"
      automountServiceAccountToken: true
      restartPolicy: OnFailure
      affinity:
  ttlSecondsAfterFinished: 1800
