{{- if eq (.Values.oidc.enabled | toString) "true" }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "spire.fullname" . }}-oidc-discovery-provider
  namespace: {{ .Release.Namespace }}
data:
  oidc-discovery-provider.conf: |
    log_level = "{{ .Values.oidc.config.logLevel }}"

    domains = [
      "spire-oidc.{{ .Release.Namespace }}",
      "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local",
    {{- if gt (len .Values.oidc.config.domains) 0 }}
      "{{- join "\",\n      \"" .Values.oidc.config.domains }}"
    {{- end }}
    ]

    {{- if .Values.oidc.insecureScheme.enabled }}
    allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
    listen_socket_path = "/run/spire/oidc-sockets/spire-oidc-server.sock"
    {{- else }}
    acme {
      directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
      cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}"
      tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }}
      email = "{{ .Values.oidc.config.acme.emailAddress }}"
    }
    {{- end }}

    workload_api {
      socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}"
      trust_domain = "{{ .Values.spire.trustDomain }}"
    }

    health_checks {
      bind_port = "8008"
      ready_path = "/ready"
      live_path = "/live"
    }
  {{- if .Values.oidc.insecureScheme.enabled }}
  default.conf.template: |
    upstream oidc {
      server unix:/run/spire/oidc-sockets/spire-oidc-server.sock;
    }

    server {
      listen            80;
      listen       [::]:80;

      location / {
        proxy_pass http://oidc;
        proxy_set_header Host $host;
      }
    }
  {{- end }}
{{ end }}