apiVersion: batch/v1
kind: Job
metadata:
  name: postsync-create-roxsecrets-job
  namespace: stackrox
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  template:
    spec:
      containers:
        - image: quay.io/gnunn/tools:4.10-1
          env:
          - name: PASSWORD
            valueFrom:
              secretKeyRef:
                key: password
                name: central-htpasswd
          envFrom:
          - configMapRef:
              name: roxsecret-namespaces
          command:
          - /bin/bash
          - -c
          - |
            # Wait for central to be ready
            attempt_counter=0
            max_attempts=20
            echo "Waiting for central to be available..."
            until $(curl -k --output /dev/null --silent --head --fail https://$CENTRAL_URL); do
              if [ ${attempt_counter} -eq ${max_attempts} ];then
                echo "Max attempts reached"
                exit 1
              fi
              printf '.'
              attempt_counter=$(($attempt_counter+1))
              echo "Made attempt $attempt_counter, waiting..."
              sleep 10
            done

            API_ENDPOINT="/v1/apitokens/generate"
            CENTRAL_URL_API="https://$CENTRAL_URL$API_ENDPOINT"
            echo "Central API endpoint: $CENTRAL_URL_API"
            echo "Creating secrets in namespaces $NAMESPACES"

            for NAMESPACE in ${NAMESPACES//,/ }
            do
              echo "Creating secret for $NAMESPACE"
              if [[ `oc get namespace $NAMESPACE 2>/dev/null` ]] ;
              then
                  echo "Namespace '$NAMESPACE' exists, checking secret..."
              else
                  echo "Namespace '$NAMESPACE' doesn't exist, skipping"
                  continue
              fi

              # If secret already exists, don't regenerate.
              if [[ -n `oc get secret roxsecrets -n $NAMESPACE 2>/dev/null` ]] ;
              then
                  echo "Stackrox token secret already exists in $NAMESPACE"
                  continue
              fi
              PAYLOAD="{\"name\": \"$NAMESPACE\", \"role\": \"Continuous Integration\"}"
              echo "$PAYLOAD"
              echo "Generate new token."
              RESPONSE=$(curl -k \
                -X POST -u "admin:$PASSWORD" \
                -H "Content-Type: application/json" \
                --data "$PAYLOAD" \
                $CENTRAL_URL_API)
              TOKEN=$(jq -r '.token' <<< "$RESPONSE")

              # Create secret in target namespace
              oc create secret generic roxsecrets \
                --from-literal=rox_central_endpoint=$CENTRAL_URL:443 \
                --from-literal=rox_api_token=$TOKEN \
                -n $NAMESPACE
            done
          name: create-secrets
      dnsPolicy: ClusterFirst
      restartPolicy: Never
      terminationGracePeriodSeconds: 30
      serviceAccount: postsync-create-roxsecrets
      serviceAccountName: postsync-create-roxsecrets