{{- if and .Values.platform.createCredentialsSecret .Values.objectStore.claimName }}
# Stable secret name for platform workers. Populated by a post-install Job once the OBC secret exists.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "cloudhost-ceph.labels" . | nindent 4 }}
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-weight: "1"
    helm.sh/hook-delete-policy: before-hook-creation
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-weight: "1"
    helm.sh/hook-delete-policy: before-hook-creation
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "patch", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
  namespace: {{ .Values.namespace }}
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-weight: "1"
    helm.sh/hook-delete-policy: before-hook-creation
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
subjects:
  - kind: ServiceAccount
    name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
    namespace: {{ .Values.namespace }}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "cloudhost-ceph.labels" . | nindent 4 }}
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-weight: "10"
    helm.sh/hook-delete-policy: before-hook-creation
spec:
  backoffLimit: 30
  template:
    spec:
      serviceAccountName: {{ include "cloudhost-ceph.fullname" . }}-bucket-sync
      restartPolicy: OnFailure
      containers:
        - name: sync
          image: registry.abrban.com/proxy-dockerhub/bitnami/kubectl:1.32
          imagePullPolicy: IfNotPresent
          env:
            - name: OBC_SECRET
              value: {{ printf "obc-%s-%s" .Values.namespace .Values.objectStore.claimName | quote }}
            - name: TARGET_SECRET
              value: {{ .Values.platform.credentialsSecretName | quote }}
            - name: NAMESPACE
              value: {{ .Values.namespace | quote }}
            - name: ENDPOINT
              value: {{ .Values.platform.endpoint | quote }}
            - name: REGION
              value: {{ .Values.platform.region | quote }}
          command:
            - /bin/bash
            - -ec
            - |
              echo "Waiting for OBC secret ${OBC_SECRET} in ${NAMESPACE}..."
              for i in $(seq 1 120); do
                if kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" >/dev/null 2>&1; then
                  break
                fi
                sleep 10
              done
              kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" >/dev/null

              BUCKET=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.BUCKET_NAME}' | base64 -d)
              ACCESS=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)
              SECRET=$(kubectl get secret -n "${NAMESPACE}" "${OBC_SECRET}" -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)

              cat <<EOF | kubectl apply -f -
              apiVersion: v1
              kind: Secret
              metadata:
                name: ${TARGET_SECRET}
                namespace: ${NAMESPACE}
                labels:
                  app.kubernetes.io/part-of: cloudhost
              type: Opaque
              stringData:
                SOURCE_STORAGE_ENDPOINT: "${ENDPOINT}"
                SOURCE_STORAGE_REGION: "${REGION}"
                SOURCE_STORAGE_BUCKET: "${BUCKET}"
                SOURCE_STORAGE_ACCESS_KEY: "${ACCESS}"
                SOURCE_STORAGE_SECRET_KEY: "${SECRET}"
              EOF
              echo "Synced bucket credentials to secret ${TARGET_SECRET} (bucket=${BUCKET})"
{{- end }}