{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
{{- $_ := include "clustermesh-apiserver-generate-certs.helm.setup-ca" . -}}
{{- $cn := "clustermesh-apiserver.cilium.io" }}
{{- $ip := prepend .Values.clustermesh.apiserver.tls.server.extraIpAddresses "127.0.0.1" "::1" }}
{{- $dns := prepend .Values.clustermesh.apiserver.tls.server.extraDnsNames $cn "*.mesh.cilium.io" }}
{{- $cert := genSignedCert $cn $ip $dns (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .cmca -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: clustermesh-apiserver-server-cert
  namespace: {{ .Release.Namespace }}
type: kubernetes.io/tls
data:
  ca.crt:  {{ .cmca.Cert | b64enc }}
  tls.crt: {{ $cert.Cert | b64enc }}
  tls.key: {{ $cert.Key  | b64enc }}
{{- end }}

{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.clustermesh.apiserver.tls.auto.enabled (eq .Values.clustermesh.apiserver.tls.auto.method "helm") }}
{{- $_ := include "clustermesh-apiserver-generate-certs.helm.setup-ca" . -}}
{{- $cn := "clustermesh-apiserver.cilium.io" }}
{{- $ip := concat (list "127.0.0.1" "::1") .Values.clustermesh.apiserver.tls.server.extraIpAddresses }}
{{- $dns := concat (list $cn "*.mesh.cilium.io") .Values.clustermesh.apiserver.tls.server.extraDnsNames }}
{{- $cert := genSignedCert $cn $ip $dns (.Values.clustermesh.apiserver.tls.auto.certValidityDuration | int) .cmca -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: clustermesh-apiserver-server-cert
  namespace: {{ .Release.Namespace }}
type: kubernetes.io/tls
data:
  ca.crt:  {{ .cmca.Cert | b64enc }}
  tls.crt: {{ $cert.Cert | b64enc }}
  tls.key: {{ $cert.Key  | b64enc }}
{{- end }}

Fix Helm template for externalWorkloads
helm: Fix Helm template for externalWorkloads

This fixes an error where instantiating the Helm chart with
`externalWorkloads.enabled=true` would fail due an invalid prefix
command in our Helm template:

```
Error: template: cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml:4:11:
 executing "cilium/templates/clustermesh-apiserver/tls-helm/server-secret.yaml" at
  <prepend>: wrong number of args for prepend: want 2 got 3
```

Fixes: 4635ffaced50 ("refactor cert-gen logic")
Reported by: Slack user `night` on cilium.slack.com

Signed-off-by: Sebastian Wicki <db043b2055cb3a47b2eb0b5aebf4e114a8c24a5a@isovalent.com>
