{{- if or .Values.minio.rootUser.generateSecret }}
{{- $default__extra_labels := dict "app.kubernetes.io/instance" .Release.Name }}
{{- $default__extra_annotations := dict "argocd.argoproj.io/compare-options" "IgnoreExtraneous" "argocd.argoproj.io/sync-options" "Prune=false" }}
{{- $key_config__root_username := dict "length" 16 "characters" (dict "lowercase" true) }}
{{- $key_config__root_password := dict "length" 64 "characters" (dict "lowercase" true "uppercase" true "numbers" true) }}
apiVersion: batch/v1
kind: Job
metadata:
  name: deploykf-minio-generate-secrets
  namespace: {{ .Release.Namespace | quote }}
  labels:
    helm.sh/chart: {{ include "deploykf-minio.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-minio.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: generate
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
spec:
  template:
    metadata:
      annotations:
        ## NOTE: istio sidecar is not needed as we only talk to k8s api, and don't want to manually quit it when the job is done
        sidecar.istio.io/inject: "false"
      labels:
        app.kubernetes.io/name: {{ include "deploykf-minio.labels.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/managed-by: {{ .Release.Service }}
        app.kubernetes.io/component: generate
    spec:
      restartPolicy: OnFailure
      {{- if or .Values.generate.kubectlImage.pullSecret }}
      imagePullSecrets:
        - name: {{ .Values.generate.kubectlImage.pullSecret | quote }}
      {{- end }}
      nodeSelector: {}
      affinity: {}
      tolerations: []
      serviceAccountName: deploykf-minio-generate-jobs
      securityContext: {}
      initContainers: []
      containers:
        {{- if .Values.minio.rootUser.generateSecret }}
        ################################################################
        ## minio | root-user
        ################################################################
        - name: generate-minio-root-user
          image: {{ .Values.generate.kubectlImage.repository }}:{{ .Values.generate.kubectlImage.tag }}
          imagePullPolicy: {{ .Values.generate.kubectlImage.pullPolicy }}
          securityContext:
            runAsUser: {{ .Values.generate.kubectlImage.uid }}
            runAsGroup: {{ .Values.generate.kubectlImage.gid }}
          command:
            - "/job-scripts/generate_kubernetes_secret.sh"
          args: []
          env:
            - name: SECRET_NAME
              value:  {{ .Values.minio.rootUser.existingSecret | quote }}
            - name: SECRET_KEYS
              {{- $secret_keys := dict .Values.minio.rootUser.existingSecretUsernameKey $key_config__root_username .Values.minio.rootUser.existingSecretPasswordKey $key_config__root_password }}
              value: |-
                {{- $secret_keys | toJson | nindent 16 }}
            - name: SECRET_LABEL
              value: "deploykf-minio.deploykf.org/generated-minio-root-user"
            - name: SECRET_EXTRA_LABELS
              value: |-
                {{- $default__extra_labels | toJson | nindent 16 }}
            - name: SECRET_EXTRA_ANNOTATIONS
              {{- $argocd_tracking_id := printf "%s:%s/%s:%s/%s" .Release.Name "" "Secret" .Release.Namespace .Values.minio.rootUser.existingSecret }}
              {{- $extra_annotations := merge (dict "argocd.argoproj.io/tracking-id" $argocd_tracking_id) $default__extra_annotations }}
              value: |-
                {{- $extra_annotations | toJson | nindent 16 }}
          volumeMounts:
            - name: job-scripts
              mountPath: "/job-scripts/"
        {{- end }}

      volumes:
        - name: job-scripts
          configMap:
            name: deploykf-minio-generate-scripts
            items:
              - key: generate_kubernetes_secret.sh
                path: generate_kubernetes_secret.sh
                mode: 0755
{{- end }}