From 9f5f7463650c0db1c2473e77efe209f60600ec66 Mon Sep 17 00:00:00 2001
From: Aliaksei Dziauho <a.dziauho@sap.com>
Date: Wed, 26 Aug 2026 12:23:53 +0200
Subject: [PATCH] add: shoot dashboards certificate

---
 .../extension-oidc-apps-controller.yaml       | 15 ++++++++-----
 .../templates/public-domain-certificate.yaml  | 21 +++++++++++++++++++
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/global/cc-gardener/templates/extension-oidc-apps-controller.yaml b/global/cc-gardener/templates/extension-oidc-apps-controller.yaml
index 6414848fe95..9f53bd997c8 100644
--- a/global/cc-gardener/templates/extension-oidc-apps-controller.yaml
+++ b/global/cc-gardener/templates/extension-oidc-apps-controller.yaml
@@ -39,7 +39,8 @@ spec:
             - ALL
         targets:
         - istioGateway:
-            create: false
+            create: true
+            tlsSecretRef: {{ $.Values.extensions.oidcAppsController.tlsSecretName | required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
             labels:
               endpoint.shoot.gardener.cloud/advertise: "true"
               endpoint.shoot.gardener.cloud/application: credativ--plutono
@@ -52,7 +53,8 @@ spec:
               gardener.cloud/role: shoot
           targetPort: 3000
         - istioGateway:
-            create: false
+            create: true
+            tlsSecretRef: {{ $.Values.extensions.oidcAppsController.tlsSecretName | required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
             labels:
               endpoint.shoot.gardener.cloud/advertise: "true"
               endpoint.shoot.gardener.cloud/application: prometheus--prometheus
@@ -69,7 +71,8 @@ spec:
               gardener.cloud/role: shoot
           targetPort: 9090
         - istioGateway:
-            create: false
+            create: true
+            tlsSecretRef: {{ $.Values.extensions.oidcAppsController.tlsSecretName | required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
             labels:
               endpoint.shoot.gardener.cloud/advertise: "true"
               endpoint.shoot.gardener.cloud/application: prometheus--alertmanager
@@ -82,7 +85,8 @@ spec:
               gardener.cloud/role: shoot
           targetPort: 9093
         - istioGateway:
-            create: false
+            create: true
+            tlsSecretRef: {{ $.Values.extensions.oidcAppsController.tlsSecretName | required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
           labelSelector:
             matchLabels:
               component: plutono
@@ -92,7 +96,8 @@ spec:
               kubernetes.io/metadata.name: garden
           targetPort: 3000
         - istioGateway:
-            create: false
+            create: true
+            tlsSecretRef: {{ $.Values.extensions.oidcAppsController.tlsSecretName | required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
           labelSelector:
             matchLabels:
               component: alertmanager
diff --git a/global/cc-gardener/templates/public-domain-certificate.yaml b/global/cc-gardener/templates/public-domain-certificate.yaml
index fa61a95d722..c296aa599e5 100644
--- a/global/cc-gardener/templates/public-domain-certificate.yaml
+++ b/global/cc-gardener/templates/public-domain-certificate.yaml
@@ -15,3 +15,24 @@ spec:
   usages:
   - digital signature
 {{- end }}
+
+{{- if .Values.extensions.oidcAppsController.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: shoot-dashboards-wildcard
+  namespace: istio-ingress
+spec:
+  dnsNames:
+  {{- for $dnsName := .Values.extensions.oidcAppsController.dashboardDnsNames }}
+  - {{ $dnsName }}
+  {{- end }}
+  issuerRef:
+    group: certmanager.cloud.sap
+    kind: DigicertIssuer
+    name: digicert-issuer
+  secretName: {{ .Values.extensions.oidcAppsController.tlsSecretName required "missing value for .Values.extensions.oidcAppsController.tlsSecretName" }}
+  usages:
+  - digital signature
+  - key encipherment
+{{- end }}