{{- $tlsCount := 0 }}
{{- if .Values.tls.externalSecret.enabled }}
{{-   $tlsCount = add $tlsCount 1 }}
{{- end }}
{{- if .Values.tls.certManager.enabled }}
{{-   $tlsCount = add $tlsCount 1 }}
{{- end }}
{{- if ne $tlsCount 1 }}
{{-   fail "You must have one and only one TLS configuration enabled" }}
{{- end }}
{{- if lt (len .Values.auth.plugins) 1 }}
{{-   fail "You must have at least one auth plugin defined" }}
{{- end }}
{{- if not (or .Values.rest.enabled .Values.grpc.enabled) }}
{{-   fail "You must have rest and/or grpc enabled" }}
{{- end }}
{{- $trustDomain := include "spire-lib.trust-domain" . }}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spire-identity-exchange.fullname" . }}
  namespace: {{ include "spire-identity-exchange.namespace" . }}
  {{- with .Values.configMap.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
data:
  six.conf: |
    name: spire-identity-exchange
    logLevel: info
    server:
      port: 8443
      restPort: 8444
      metricsPort: 4950
      tls:
        certFile: /secret/tls.crt
        keyFile: /secret/tls.key
    spire:
      agentWorkloadSocketPath: /spiffe-workload-api/spire-agent.sock
      agentDelegatedSocketPath: /agent/admin.sock
      trustDomain: {{ $trustDomain }}
      svidTTL: 1h
    auth:
      plugins:
        {{- toYaml .Values.auth.plugins | nindent 8 }}
      {{ with .Values.auth.stacks }}
      stacks:
        {{- toYaml . | nindent 8 }}
      {{- end }}

  six-agent.conf: |
    agent {
        log_level = "DEBUG"
        trust_domain = {{ $trustDomain | quote }}
        server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }}
        server_port = {{ .Values.server.port }}
        trust_bundle_url = "http://localhost/trustbundle"
        trust_bundle_unix_socket = "/trustbundle/socket"
        rebootstrap_mode = "always"
        rebootstrap_delay = "5m"

        data_dir = "/agent-data"
        admin_socket_path = "/agent/admin.sock"
        authorized_delegates = ["spiffe://{{ $trustDomain }}/service/spire-identity-exchange"]
    }

    health_checks {
        listener_enabled = true
        bind_address = "0.0.0.0"
        bind_port =  8182
        live_path = "/live"
        ready_path = "/ready"
    }

    plugins {
       KeyManager "memory" {
            plugin_data {}
        }

        NodeAttestor "x509pop" {
            plugin_data {
                spiffe_endpoint_socket = "unix:///spiffe-workload-api/spire-agent.sock"
            }
        }

        WorkloadAttestor "unix" {
            plugin_data {
              # Only used for delegated api. Can be removed for the broker api in the future.
              discover_workload_path = true
              workload_size_limit = -1
            }
        }
    }