# PostSync Job to copy ddb-cluster-app credentials to iam namespace
# Allows authentik to reference 'app' user credentials locally
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sync-db-credentials
  namespace: iam
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-copier
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sync-db-credentials
subjects:
  - kind: ServiceAccount
    name: sync-db-credentials
    namespace: iam
roleRef:
  kind: ClusterRole
  name: secret-copier
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
  name: sync-db-credentials
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: sync-db-credentials
      restartPolicy: Never
      containers:
      - name: copy-secret
        image: alpine/k8s:1.30.3
        command:
        - /bin/sh
        - -c
        - |
          set -e
          echo "Copying ddb-cluster-app secret from ddb to iam namespace..."
          
          # Get secret from ddb namespace
          kubectl get secret ddb-cluster-app -n ddb -o json | \
            jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.ownerReferences) | .metadata.namespace="iam"' | \
            kubectl apply -f -
          
          echo "Secret copied successfully"