#@ load("@ytt:data", "data")

#@ ns = data.values.application.namespace
#@ app = data.values.application

#@ init_script = """\
#@ set -eu
#@
#@ ADMIN_TOKEN=$(cat /etc/garage/admin_token)
#@ AUTH="Authorization: Bearer ${ADMIN_TOKEN}"
#@ ADMIN="http://garage.""" + ns + """.svc:3903"
#@ OCIS_NS=\"""" + app.ocis.namespace + """\"
#@ OCIS_SECRET=\"""" + app.ocis.secretName + """\"
#@ BUCKET_NAME=\"""" + app.bucket.name + """\"
#@ KEY_NAME=\"""" + app.bucket.keyName + """\"
#@
#@ echo "[garage-init] checking k8s secret ${OCIS_SECRET} in ${OCIS_NS}..."
#@ EXISTING_AK=$(kubectl get secret "${OCIS_SECRET}" -n "${OCIS_NS}" -o jsonpath='{.data.accessKey}' 2>/dev/null || echo "")
#@ EXISTING_SK=$(kubectl get secret "${OCIS_SECRET}" -n "${OCIS_NS}" -o jsonpath='{.data.secretKey}' 2>/dev/null || echo "")
#@ if [ -n "${EXISTING_AK}" ] && [ -n "${EXISTING_SK}" ]; then
#@   echo "[garage-init] ${OCIS_SECRET} already populated; skipping (idempotent exit)"
#@   exit 0
#@ fi
#@
#@ echo "[garage-init] waiting for admin API..."
#@ until curl -fsS "${ADMIN}/health" >/dev/null 2>&1; do sleep 2; done
#@
#@ echo "[garage-init] checking cluster layout..."
#@ STATUS=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/status")
#@ NODE_ID=$(echo "${STATUS}" | jq -r '.nodes[0].id')
#@ CUR_VERSION=$(echo "${STATUS}" | jq -r '.layoutVersion // 0')
#@
#@ if [ "${CUR_VERSION}" = "0" ] || [ "${CUR_VERSION}" = "null" ]; then
#@   echo "[garage-init] applying initial layout for node ${NODE_ID}"
#@   curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
#@     -d "[{\\"id\\":\\"${NODE_ID}\\",\\"zone\\":\\"dc1\\",\\"capacity\\":1073741824,\\"tags\\":[]}]" \\
#@     "${ADMIN}/v1/layout"
#@   curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
#@     -d '{"version":1}' \\
#@     "${ADMIN}/v1/layout/apply"
#@   echo "[garage-init] layout applied, waiting for cluster ready..."
#@   for i in $(seq 1 30); do
#@     READY=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/status" | jq -r '.layoutVersion')
#@     if [ "${READY}" = "1" ]; then break; fi
#@     sleep 2
#@   done
#@ else
#@   echo "[garage-init] layout already at version ${CUR_VERSION}, skipping"
#@ fi
#@
#@ echo "[garage-init] ensuring bucket ${BUCKET_NAME}..."
#@ BUCKET_ID=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/bucket?globalAlias=${BUCKET_NAME}" 2>/dev/null | jq -r '.id // empty')
#@ if [ -z "${BUCKET_ID}" ]; then
#@   BUCKET_ID=$(curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
#@     -d "{\\"globalAlias\\":\\"${BUCKET_NAME}\\"}" \\
#@     "${ADMIN}/v1/bucket" | jq -r '.id')
#@   echo "[garage-init] created bucket ${BUCKET_ID}"
#@ else
#@   echo "[garage-init] bucket exists: ${BUCKET_ID}"
#@ fi
#@
#@ echo "[garage-init] resetting key ${KEY_NAME} (need fresh secret)..."
#@ EXISTING_KEY_ID=$(curl -fsS -H "${AUTH}" "${ADMIN}/v1/key?search=${KEY_NAME}" 2>/dev/null | jq -r '.accessKeyId // empty')
#@ if [ -n "${EXISTING_KEY_ID}" ]; then
#@   echo "[garage-init] deleting stale key ${EXISTING_KEY_ID}"
#@   curl -fsS -X DELETE -H "${AUTH}" "${ADMIN}/v1/key?id=${EXISTING_KEY_ID}" >/dev/null
#@ fi
#@ KEY_INFO=$(curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
#@   -d "{\\"name\\":\\"${KEY_NAME}\\"}" \\
#@   "${ADMIN}/v1/key")
#@ ACCESS_KEY=$(echo "${KEY_INFO}" | jq -r '.accessKeyId')
#@ SECRET_KEY=$(echo "${KEY_INFO}" | jq -r '.secretAccessKey')
#@ if [ -z "${ACCESS_KEY}" ] || [ -z "${SECRET_KEY}" ] || [ "${SECRET_KEY}" = "null" ]; then
#@   echo "[garage-init] failed to create key: ${KEY_INFO}"
#@   exit 1
#@ fi
#@ echo "[garage-init] created key ${ACCESS_KEY}"
#@
#@ echo "[garage-init] granting bucket permissions..."
#@ curl -fsS -X POST -H "${AUTH}" -H 'Content-Type: application/json' \\
#@   -d "{\\"bucketId\\":\\"${BUCKET_ID}\\",\\"accessKeyId\\":\\"${ACCESS_KEY}\\",\\"permissions\\":{\\"read\\":true,\\"write\\":true,\\"owner\\":true}}" \\
#@   "${ADMIN}/v1/bucket/allow" >/dev/null
#@
#@ echo "[garage-init] writing ${OCIS_SECRET} to ${OCIS_NS}..."
#@ kubectl create secret generic "${OCIS_SECRET}" \\
#@   -n "${OCIS_NS}" \\
#@   --from-literal=accessKey="${ACCESS_KEY}" \\
#@   --from-literal=secretKey="${SECRET_KEY}" \\
#@   --dry-run=client -o yaml | kubectl apply -f -
#@
#@ echo "[garage-init] done."
#@ """

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: garage-init
  namespace: #@ ns

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: garage-init-ocis-secret
  namespace: #@ app.ocis.namespace
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "create", "patch", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: garage-init-ocis-secret
  namespace: #@ app.ocis.namespace
subjects:
  - kind: ServiceAccount
    name: garage-init
    namespace: #@ ns
roleRef:
  kind: Role
  name: garage-init-ocis-secret
  apiGroup: rbac.authorization.k8s.io

---
apiVersion: batch/v1
kind: Job
metadata:
  name: garage-init
  namespace: #@ ns
  annotations:
    argocd.argoproj.io/sync-options: Replace=true,Force=true
spec:
  ttlSecondsAfterFinished: 300
  backoffLimit: 30
  template:
    spec:
      serviceAccountName: garage-init
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: init
          image: alpine/k8s:1.32.3
          command: ["sh", "-c"]
          args:
            - #@ init_script
          volumeMounts:
            - name: garage-secrets
              mountPath: /etc/garage
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
      volumes:
        - name: garage-secrets
          secret:
            secretName: garage-secrets
