#@ load("@ytt:data", "data")
#@ load("@ytt:overlay", "overlay")

#! ns.ytt.yaml runs first (alphabetical) and rewrites every resource's
#! namespace to data.values.application.namespace. The Role/RoleBinding
#! created by init-job.ytt.yaml live in the ocis namespace (so the
#! garage init Job can write ocis-s3-credentials there) — re-pin them
#! after ns.ytt.yaml clobbered the namespace.

#@ ocis_ns = data.values.application.ocis.namespace

#@overlay/match by=overlay.subset({"kind": "Role", "metadata": {"name": "garage-init-ocis-secret"}}), expects="1+"
---
metadata:
  namespace: #@ ocis_ns

#@overlay/match by=overlay.subset({"kind": "RoleBinding", "metadata": {"name": "garage-init-ocis-secret"}}), expects="1+"
---
metadata:
  namespace: #@ ocis_ns
