###############################################################################
#
# Licensed Materials - Property of IBM
#
# 5737-H33
#
# (C) Copyright IBM Corp. 2018, 2019  All Rights Reserved.
#
# US Government Users Restricted Rights - Use, duplication or
# disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
#
###############################################################################
# Runs a container that registers the IBM Event Streams UI as an OAuth endpoint
#  to allow log-ins to the Event Streams Admin UI
###############################################################################
{{ if eq .Values.license "accept" -}}
{{- include "sch.config.init" (list . "sch.chart.config.values") -}}
{{- include "sch.config.init" (list . "securitycontext.sch.chart.config.values") | trim -}}
{{ $namePrefix := .sch.chart.components.essential.certGenJob.name -}}
{{ $name := include "sch.names.fullCompName" (list . $namePrefix ) -}}
# Component is 'essential'
{{ $compName := .sch.chart.components.essential.compName -}}
{{ $labels := include "sch.metadata.labels.standard" (list . $compName (dict "function" "setup-secrets")) -}}
# Name of the new temporary service account
{{ $serviceAccount := .sch.chart.components.essential.preInstallSA.name -}}
{{ $serviceAccountName := include "sch.names.fullCompName" (list . $serviceAccount) -}}
{{ $proxySecretNamePrefix := .sch.chart.components.proxy.secret.name -}}
{{ $proxySecretName := include "sch.names.fullCompName" (list . $proxySecretNamePrefix ) -}}
{{ $jmxSecretNamePrefix := .sch.chart.components.kafka.jmxSecret.name -}}
{{ $jmxSecretName := include "sch.names.fullCompName" (list . $jmxSecretNamePrefix ) -}}
# Validation of user supplied input
{{- if eq .Values.tls.type  "provided"}}
  # user has supplied their own certificate details
  {{- if empty .Values.tls.key }}
    {{ fail "Configuration error: Please enter the Base64 encoded TLS private key in Secure connections section." }}
  {{- end }}
  {{- if empty .Values.tls.cert }}
    {{ fail "Configuration error: Please enter the Base64 encoded TLS certificate in Secure connections section." }}
  {{- end }}
  {{- if empty .Values.tls.cacert }}
    {{ fail "Configuration error: Please enter the Base64 encoded CA certificate in Secure connections section." }}
  {{- end }}
  {{- if eq (regexMatch "^[A-Za-z0-9+/]*={0,3}$" .Values.tls.key) false}}
    {{ fail "Configuration error: Please enter a valid Base64 encoded TLS private key in Secure connections section." }}
  {{- end }}
  {{- if eq (regexMatch "^[A-Za-z0-9+/]*={0,3}$" .Values.tls.cert) false }}
    {{ fail "Configuration error: Please enter a valid Base64 encoded TLS certificate in Secure connections section." }}
  {{- end }}
  {{- if eq (regexMatch "^[A-Za-z0-9+/]*={0,3}$" .Values.tls.cacert) false }}
    {{ fail "Configuration error: Please enter a valid Base64 encoded CA certificate in Secure connections section." }}
  {{- end }}
{{- end }}
{{- if eq .Values.tls.type  "selfsigned"}}
  {{- if .Values.tls.key }}
  {{ fail "Configuration error: You cannot select self-signed certificate and provide a TLS private key." }}
  {{- end }}
  {{- if .Values.tls.cert }}
  {{ fail "Configuration error: You cannot select self-signed certificate and provide a TLS certificate." }}
  {{- end }}
  {{- if .Values.tls.cacert }}
  {{ fail "Configuration error: You cannot select self-signed certificate and provide a CA certificate." }}
  {{- end }}
{{- end }}
# k8s configuration
{{ $clusterName := .Values.global.k8s.clusterName -}}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ $name | quote }}
  namespace: {{ include "restrict.namespace" (list . .Release.Namespace) }}
  labels:
{{ $labels | indent 4 }}
  annotations:
    # This needs to run before we deploy, as UI component installs
    # depend on the secrets existing already, and will fail to start
    # otherwise.
    "helm.sh/hook": pre-install, pre-upgrade, pre-rollback
    # We don't delete this if it fails, as the logs may be useful to
    # diagnose a failed install
    "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
    # This needs to happen before all other jobs as they will need access to this
    # image pull secret
    "helm.sh/hook-weight": "5"
spec:
  template:
    metadata:
      namespace: {{ include "restrict.namespace" (list . .Release.Namespace) }}
      labels:
{{ $labels | indent 8 }}
        job: "pre-install-cert-gen"
    spec:
      {{- if .Values.global.image.pullSecret }}
      imagePullSecrets:
        - name: {{ .Values.global.image.pullSecret }}
      {{- end }}
      serviceAccountName: {{ $serviceAccountName }}
      hostNetwork: false
      hostPID: false
      hostIPC: false
      securityContext:
{{- include "sch.security.securityContext" (list . .sch.chart.securitycontexts.pod) | indent 8 }}
      affinity:
{{ include "customNodeaffinity"  (list .) | indent 8 }}
      restartPolicy: Never
      containers:
        - name: "cert-generator"
          image: {{ include "eventstreams.image" (list . "eventstreams-certs" .Values.global.image.imageTags.certGenTag) | quote }}
          imagePullPolicy: {{ .Values.global.image.pullPolicy }}
          securityContext:
{{- include "sch.security.securityContext" (list . .sch.chart.securitycontexts.containerWritableFilesystem) | indent 12 }}
          env:
            {{- include "license.accept.env.ref" . | indent 10 }}
            - name: "ES_NAMESPACE"
              value: {{ .Release.Namespace | quote }}
            - name: "RELEASE_NAME"
              value: {{ .Release.Name | quote }}
            - name: "ES_SECRET_NAME"
              value: {{ $proxySecretName | quote }}
            {{- if eq (empty .Values.proxy.externalEndpoint) false}}
            - name: "ES_CNAME"
              value: {{ .Values.proxy.externalEndpoint }}
            {{- end }}
            {{- if eq .Values.tls.type  "provided"}}
            - name: "ES_CERT"
              value: {{ .Values.tls.cert }}
            - name: "ES_KEY"
              value: {{ .Values.tls.key }}
            - name: "ES_CACERT"
              value: {{ .Values.tls.cacert }}
            {{- end }}
            - name: "GENERATE_JMX_SECRET"
              value: {{ .Values.kafka.openJMX | quote }}
            - name: "ES_JMX_SECRET_NAME"
              value: {{ $jmxSecretName | quote }}
            - name: "CLUSTER_NAME"
              value: {{ $clusterName | quote }}
            - name: "GENERATE_CERTIFICATE"
              value: {{ .Values.global.generateCertificate | quote}}
            {{- if not (regexMatch "^[A-Za-z]+[A-Za-z0-9]*$" .Values.global.certificateSecretName) }}
              {{- fail "Configuration Error : Certificate Secret Name is not valid" }}
            {{- end }}
            - name: "CERT_SECRET_NAME"
              value: {{ .Values.global.certificateSecretName | quote }}
{{ end -}}

