{{<- if tmpl.Exec "kubeflow_katib.mysql.auth.secret_is_cloned" . >}}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: kubeflow-katib--clone-mysql-secret
  annotations:
    ## kyverno policies with "generate" cant be updated: https://github.com/kyverno/kyverno/issues/7718
    argocd.argoproj.io/sync-options: Replace=true
    ## kyverno policies that clone resources must be synced before other resources
    argocd.argoproj.io/sync-wave: "-1"
spec:
  generateExisting: true
  rules:
    {{<- $this_policy_name := "kubeflow-katib--clone-mysql-secret" >}}
    {{<- $source_secret__name := tmpl.Exec "kubeflow_katib.mysql.auth.source_secret_name" . >}}
    {{<- $source_secret__namespace := tmpl.Exec "kubeflow_katib.mysql.auth.source_secret_namespace" . >}}
    {{<- $target_secret__name := "cloned--katib-mysql-secret" >}}
    {{<- $target_secret__namespace := "kubeflow" >}}
    ## clone the secret from the source namespace to the target namespace
    - name: clone-secret
      match:
        any:
          - resources:
              kinds:
                - Namespace
              names:
                - {{< $target_secret__namespace | quote >}}
      generate:
        apiVersion: v1
        kind: Secret
        name: {{< $target_secret__name | quote >}}
        namespace: "{{ request.object.metadata.name }}"
        synchronize: true
        clone:
          namespace: {{< $source_secret__namespace | quote >}}
          name: {{< $source_secret__name | quote >}}

    ## annotate the ~cloned~ secret so that ArgoCD ignores it
    - name: annotate-cloned-secret
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{< $target_secret__name | quote >}}
              namespaces:
                - {{< $target_secret__namespace | quote >}}
              operations:
                - CREATE
                - UPDATE
              selector:
                matchLabels:
                  generate.kyverno.io/policy-name: {{< $this_policy_name | quote >}}
      mutate:
        patchStrategicMerge:
          metadata:
            annotations:
              argocd.argoproj.io/compare-options: IgnoreExtraneous
              argocd.argoproj.io/sync-options: Prune=false

    ## restart deployments using the ~cloned~ secret when the ~source~ secret is updated
    ## NOTE: kyverno ignores its own updates, so we cant trigger from the ~cloned~ secret
    - name: trigger-deployment-restarts
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{< $source_secret__name | quote >}}
              namespaces:
                - {{< $source_secret__namespace | quote >}}
              operations:
                - CREATE
                - UPDATE
      preconditions:
        all:
          - key: "{{ request.operation || 'BACKGROUND' }}"
            operator: AnyIn
            value: 
              - CREATE
              - UPDATE
      mutate:
        targets:
          - apiVersion: apps/v1
            kind: Deployment
            namespace: {{< $target_secret__namespace | quote >}}
        patchStrategicMerge:
          spec:
            template:
              metadata:
                annotations:
                  deploykf.org/restart-trigger: "{{ random('[0-9a-z]{32}') }}"
              spec:
                containers:
                  - env:
                      - valueFrom:
                          secretKeyRef:
                            <(name): {{< $target_secret__name | quote >}}
{{<- end >}}