apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "10"
  name: create-sso-auth-provider
  namespace: stackrox
spec:
  template:
    spec:
      containers:
        - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
          env:
          - name: CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: sso-secret
                key: client-secret
          - name: PASSWORD
            valueFrom:
              secretKeyRef:
                name: central-htpasswd
                key: password
          - name: ISSUER
            value: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift
          - name: DEFAULT_ROLE
            value: Admin
          command:
            - /bin/bash
            - -c
            - |
              #!/usr/bin/env bash

              # Wait for central to be ready
              attempt_counter=0
              max_attempts=20
              echo "Waiting for central to be available..."
              until $(curl -k --output /dev/null --silent --head --fail https://central); do
                  if [ ${attempt_counter} -eq ${max_attempts} ];then
                    echo "Max attempts reached"
                    exit 1
                  fi
                  printf '.'
                  attempt_counter=$(($attempt_counter+1))
                  echo "Made attempt $attempt_counter, waiting..."
                  sleep 5
              done

              echo "Configuring SSO Provider"

              echo "Test if SSO Provider already exists"

              response=$(curl -k -u "admin:$PASSWORD" https://central/v1/authProviders?name=OpenShift | python3 -c "import sys, json; print(json.load(sys.stdin)['authProviders'], end = '')")

              if [[ "$response" != "[]" ]] ; then
                echo "OpenShift Provider already exists, exiting"
                exit 0
              fi

              export DATA='{"name":"OpenShift","type":"oidc","uiEndpoint":"central-stackrox.apps.home.ocplab.com","enabled":true,"config":{"client_id":"stackrox","client_secret":"'${CLIENT_SECRET}'","issuer":"'$ISSUER'","mode":"post"},"validated":true,"extraUiEndpoints":[],"active":true}'

              echo "Posting data: ${DATA}"

              authid=$(curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/authProviders | python3 -c "import sys, json; print(json.load(sys.stdin)['id'], end = '')")

              echo "Authentication Provider created with id ${authid}"
              echo "Updating minimum role to Admin"

              export DATA='{"previous_groups":[],"required_groups":[{"props":{"authProviderId":"'${authid}'"},"roleName":"'${DEFAULT_ROLE}'"}]}'

              curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/groupsbatch

          imagePullPolicy: Always
          name: create-sso-auth-provider
      dnsPolicy: ClusterFirst
      restartPolicy: Never
      serviceAccount: create-cluster-init
      serviceAccountName: create-cluster-init
      terminationGracePeriodSeconds: 30