# A self-signed root issuer and CA, then a CA issuer that the operator uses to
# mint internode and frontend certificates. Requires cert-manager installed.
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: temporal-selfsigned
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: temporal-ca
spec:
  isCA: true
  commonName: temporal-ca
  secretName: temporal-ca
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: temporal-selfsigned
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: temporal-ca-issuer
spec:
  ca:
    secretName: temporal-ca

# A TemporalCluster with cert-manager-driven mTLS, backed by the CNPG Postgres
# from the postgres suite fixtures.
apiVersion: temporal.bmor10.com/v1alpha1
kind: TemporalCluster
metadata:
  name: temporal-mtls
spec:
  version: "1.31.1"
  numHistoryShards: 512
  mtls:
    provider: cert-manager
    issuerRef:
      name: temporal-ca-issuer
      kind: Issuer
  persistence:
    defaultStore:
      sql:
        pluginName: postgres12
        host: temporal-pg-rw
        port: 5432
        database: temporal
        user: temporal
        passwordSecretRef:
          name: temporal-pg-app
          key: password
    visibilityStore:
      sql:
        pluginName: postgres12
        host: temporal-pg-rw
        port: 5432
        database: temporal_visibility
        user: temporal
        passwordSecretRef:
          name: temporal-pg-app
          key: password