{{- if .Values.tenant.wildcardHost }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: tenants-wildcard
  namespace: tenants
  labels:
    app.kubernetes.io/managed-by: cluster-platform-v3
  annotations:
    # See cluster-issuer.yaml for sync-wave rationale. Certificate
    # also references the cert-manager.io CRD that lands via the
    # subchart; without a wave bump Argo discovery fails on first sync.
    argocd.argoproj.io/sync-wave: "5"
spec:
  secretName: tenants-wildcard-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: {{ .Values.tenant.wildcardHost | quote }}
  dnsNames:
    - {{ .Values.tenant.wildcardHost | quote }}
  renewBefore: 720h
{{- end }}