{{- if not .Values.secrets.existingSecret }}
{{/*
NOTE: lookup only works with `helm install/upgrade` (CLI). Argo CD renders with
`helm template` where lookup is always empty, so values would be regenerated on
every sync. For GitOps deployments set secrets.existingSecret and manage the
Secret out-of-band (e.g. SealedSecret in the gitops repo).
*/}}
{{- $existing := lookup "v1" "Secret" (include "cloudhost-platform.namespace" .) (include "cloudhost-platform.secretName" .) }}
{{- $pgPass := .Values.postgres.password }}
{{- if not $pgPass }}
{{- if $existing }}{{- $pgPass = index $existing.data "postgres-password" | b64dec }}{{- else }}{{- $pgPass = randAlphaNum 24 }}{{- end }}
{{- end }}
{{- $jwt := .Values.secrets.jwtSecret }}
{{- if not $jwt }}
{{- if $existing }}{{- $jwt = index $existing.data "jwt-secret" | b64dec }}{{- else }}{{- $jwt = randAlphaNum 32 }}{{- end }}
{{- end }}
{{- $jwtRefresh := .Values.secrets.jwtRefreshSecret }}
{{- if not $jwtRefresh }}
{{- if $existing }}{{- $jwtRefresh = index $existing.data "jwt-refresh-secret" | b64dec }}{{- else }}{{- $jwtRefresh = randAlphaNum 32 }}{{- end }}
{{- end }}
{{- $kubeconfigKey := .Values.secrets.clusterKubeconfigKey }}
{{- if not $kubeconfigKey }}
{{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
{{- end }}
{{- $redisPass := .Values.redis.password }}
{{- if not $redisPass }}
{{- if and $existing (hasKey $existing.data "redis-password") }}{{- $redisPass = index $existing.data "redis-password" | b64dec }}{{- else }}{{- $redisPass = randAlphaNum 24 }}{{- end }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "cloudhost-platform.secretName" . }}
  namespace: {{ include "cloudhost-platform.namespace" . }}
  labels:
    {{- include "cloudhost-platform.labels" . | nindent 4 }}
type: Opaque
stringData:
  postgres-password: {{ $pgPass | quote }}
  jwt-secret: {{ $jwt | quote }}
  jwt-refresh-secret: {{ $jwtRefresh | quote }}
  cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
  redis-password: {{ $redisPass | quote }}
{{- end }}