# Default values for contour-shared-ca-issuer.
# Override per-cluster via helm-overrides/<cluster>/contour-shared-ca-issuer/custom-values.yaml.

# Namespace where cert-manager is installed. The Root CA Secret and
# ClusterIssuer's source Secret live here.
namespace: cert-manager

# ClusterIssuer name. Per-app Certificate CRs reference this via
# `issuerRef.name` (with `kind: ClusterIssuer`). Must match the name used
# by consumers — e.g. devops-helm-charts/2.0.0/templates/proxyless-grpc-cert.yaml.
issuerName: contour-ca-issuer

# Name of the K8s Secret (in `.namespace`) that holds the Root CA cert + key.
# Populated by ESO from Vault. ClusterIssuer's `spec.ca.secretName` points here.
rootCASecretName: contour-shared-ca

externalSecret:
  # Create ExternalSecret to sync the Root CA from Vault. Disable if the
  # Secret is provisioned out-of-band (e.g. sealed-secrets or manual).
  enabled: true
  # Vault KV path holding the Root CA (expects keys: tls.crt, tls.key, ca.crt).
  vaultPath: meesho/devops/contour/root-ca
  # Optional pinned Vault KV version.
  vaultVersion: ""
  # ESO refresh interval. "0" disables periodic refresh — rotation is driven
  # by `kubectl annotate externalsecret ... force-sync=...` (see runbook).
  refreshInterval: "0"
  secretStoreRef:
    # Name of the ClusterSecretStore configured for Vault. Typical values:
    #   vault-backend       — default central ClusterSecretStore
    #   vault-backend-new   — used in some farmiso clusters
    name: vault-backend

commonLabels: {}
commonAnnotations: {}