# ArgoCD Hook Jobs for Phase 3 (IAM only)

---
# ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-ca-setup
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: ca-setup
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Setting up CA ConfigMap for Authentik..."
            CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
              -o jsonpath='{.data.tls\.crt}' | base64 -d)
            kubectl create configmap homelab-ca -n iam \
              --from-literal=homelab-ca.crt="$CA_PEM" \
              --dry-run=client -o yaml | kubectl apply -f -
            echo "✓ CA ConfigMap created"

---
# ── Authentik — PostSync: OIDC Provisioning ──────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-oidc-provision
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: oidc-provision
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Waiting for Authentik server..."
            kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true
            echo "✓ Authentik ready"

---
# ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────

apiVersion: v1
kind: ServiceAccount
metadata:
  name: phase3-setup
  namespace: iam

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: phase3-setup
rules:
  - apiGroups: [""]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "list", "create", "apply", "patch"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "create"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["list", "get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: phase3-setup
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: phase3-setup
subjects:
  - kind: ServiceAccount
    name: phase3-setup
    namespace: iam