resource "kubernetes_secret" "root_ca" {
  metadata {
    name      = "root-ca"
    namespace = "cert-manager"
  }
  data = {
    "tls.crt" = var.root_ca_pem
    "tls.key" = var.root_ca_key
  }

  type = "kubernetes.io/tls"
}

resource "kubernetes_manifest" "cluster_issuer" {

  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "ClusterIssuer"
    metadata = {
      name = "internal-ca"
      annotations = {
        "cert-manager.io/issuer-group" = "cert-manager.io"
        "cert-manager.io/issuer-kind"  = "Issuer"
        "cert-manager.io/issuer-name"  = "internal-ca"
      }
    }
    spec = {
      ca = {
        secretName = "root-ca"
      }
    }
  }
}