{{- if not .Values.deployKF.pipelines.objectStore.auth.fromEnv }}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: argo-workflows--clone-bucket-secret
  annotations:
    ## kyverno policies with "generate" cant be updated: https://github.com/kyverno/kyverno/issues/7718
    argocd.argoproj.io/sync-options: Replace=true
    ## kyverno policies that clone resources must be synced before other resources
    argocd.argoproj.io/sync-wave: "-1"
  labels:
    helm.sh/chart: {{ include "kubeflow-argo-workflows.labels.chart" . }}
    app.kubernetes.io/name: {{ include "kubeflow-argo-workflows.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/component: argo
spec:
  generateExisting: true
  rules:
    {{- $this_policy_name := "argo-workflows--clone-bucket-secret" }}
    {{- $source_secret__name := .Values.deployKF_helpers.kubeflow_pipelines.object_store.auth.source_secret_name }}
    {{- $source_secret__namespace := .Values.deployKF_helpers.kubeflow_pipelines.object_store.auth.source_secret_namespace }}
    {{- $target_secret__name := .Values.deployKF_helpers.kubeflow_pipelines.object_store.auth.secret_name }}
    {{- $target_secret__namespace := .Release.Namespace }}
    ## clone the secret from the source namespace to the target namespace
    - name: clone-secret
      match:
        any:
          - resources:
              kinds:
                - Namespace
              names:
                - {{ $target_secret__namespace | quote }}
      generate:
        apiVersion: v1
        kind: Secret
        name: {{ $target_secret__name | quote }}
        namespace: {{ `"{{ request.object.metadata.name }}"` }}
        synchronize: true
        clone:
          namespace: {{ $source_secret__namespace | quote }}
          name: {{ $source_secret__name | quote }}

    ## annotate the ~cloned~ secret so that ArgoCD ignores it
    - name: annotate-cloned-secret
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{ $target_secret__name | quote }}
              namespaces:
                - {{ $target_secret__namespace | quote }}
              operations:
                - CREATE
                - UPDATE
              selector:
                matchLabels:
                  generate.kyverno.io/policy-name: {{ $this_policy_name | quote }}
      mutate:
        patchStrategicMerge:
          metadata:
            annotations:
              argocd.argoproj.io/compare-options: IgnoreExtraneous
              argocd.argoproj.io/sync-options: Prune=false

    ## restart deployments using the ~cloned~ secret when the ~source~ secret is updated
    ## NOTE: kyverno ignores its own updates, so we cant trigger from the ~cloned~ secret
    - name: trigger-deployment-restarts
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{ $source_secret__name | quote }}
              namespaces:
                - {{ $source_secret__namespace | quote }}
              operations:
                - CREATE
                - UPDATE
      preconditions:
        all:
          - key: {{ `"{{ request.operation || 'BACKGROUND' }}"` }}
            operator: AnyIn
            value:
              - CREATE
              - UPDATE
      mutate:
        targets:
          - apiVersion: apps/v1
            kind: Deployment
            namespace: {{ $target_secret__namespace | quote }}
        patchStrategicMerge:
          spec:
            template:
              metadata:
                annotations:
                  deploykf.org/restart-trigger: {{ `"{{ random('[0-9a-z]{32}') }}"` }}
              spec:
                containers:
                  - env:
                      - valueFrom:
                          secretKeyRef:
                            <(name): {{ $target_secret__name | quote }}
{{- end }}