{{- define "deploykf-auth.secret_list__env_vars" }}
##
## WARNING: kyverno ignores its own updates, so we can't trigger from ~cloned~ secrets
##          if you need to trigger based on a cloned secret, don't add it here,
##          add it to the policy which clones the secret and trigger off the source secret
##

## `dex.staticPasswords` secrets
{{- range $user:= .Values.dex.staticPasswords }}
{{- if and $user.password.existingSecret $user.password.existingSecretKey }}
- {{ $user.password.existingSecret }}
{{- end }}
{{- end }}

## `dex.connectors` secrets
{{- range $connector := .Values.dex.connectors }}
{{- if and $connector.configExistingSecret $connector.configExistingSecretKey }}
- {{ $connector.configExistingSecret | quote }}
{{- end }}
{{- end }}

## `dex.clients.oauth2Proxy.clientSecret` secret
{{- if .Values.dex.clients.oauth2Proxy.clientSecret.existingSecret }}
- {{ .Values.dex.clients.oauth2Proxy.clientSecret.existingSecret | quote }}
{{- end }}

## `dex.clients.minioConsole.clientSecret` secret
{{- if and .Values.dex.clients.minioConsole.enabled .Values.dex.clients.minioConsole.clientSecret.existingSecret }}
- {{ .Values.dex.clients.minioConsole.clientSecret.existingSecret | quote }}
{{- end }}

## `dex.clients.argoServer.clientSecret` secret
{{- if and .Values.dex.clients.argoServer.enabled .Values.dex.clients.argoServer.clientSecret.existingSecret }}
- {{ .Values.dex.clients.argoServer.clientSecret.existingSecret | quote }}
{{- end }}

## `oauth2Proxy.cookie.secret` secret
{{- if .Values.oauth2Proxy.cookie.secret.existingSecret }}
- {{ .Values.oauth2Proxy.cookie.secret.existingSecret | quote }}
{{- end }}
{{- end }}
{{- $secret_list__env_vars := (include "deploykf-auth.secret_list__env_vars" .) | fromYamlArray | uniq }}

{{- if $secret_list__env_vars }}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deploykf-auth--restart-on-secret-updates
  annotations:
    ## NOTE: causes argo-cd to be "out of sync" if the latest generate job has not run (pre-install jobs cant be "out of sync")
    checksum/generate-secrets-job: {{ include (print $.Template.BasePath "/generate/Job-generate-secrets.yaml") . | sha256sum }}
  labels:
    helm.sh/chart: {{ include "deploykf-auth.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-auth.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
  rules:
    - name: trigger-deployment-restarts
      match:
        any:
          - resources:
              kinds:
                - Secret
              names: {{ $secret_list__env_vars | toJson }}
              namespaces:
                - {{ .Release.Namespace | quote }}
              operations:
                - CREATE
                - UPDATE
      preconditions:
        all:
          - key: {{ `"{{ request.operation || 'BACKGROUND' }}"` }}
            operator: AnyIn
            value:
              - CREATE
              - UPDATE
      mutate:
        targets:
          - apiVersion: apps/v1
            kind: Deployment
            namespace: {{ `"{{ request.object.metadata.namespace }}"` }}
        patchStrategicMerge:
          metadata:
            labels:
              <(helm.sh/chart): {{ (include "deploykf-auth.labels.chart" .) | quote }}
          spec:
            template:
              metadata:
                annotations:
                  deploykf.org/restart-trigger: {{ `"{{ random('[0-9a-z]{32}') }}"` }}
              spec:
                containers:
                  - env:
                      - valueFrom:
                          secretKeyRef:
                            <(name): {{ `"{{ request.object.metadata.name }}"` }}
{{- end }}