# services/communication/guest-register-shared-secret-ensure-job.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: guest-register-secret-writer
  namespace: comms
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: guest-register-secret-writer
  namespace: comms
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["guest-register-shared-secret-runtime"]
    verbs: ["get", "patch", "update"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: guest-register-secret-writer
  namespace: comms
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: guest-register-secret-writer
subjects:
  - kind: ServiceAccount
    name: guest-register-secret-writer
    namespace: comms
---
apiVersion: batch/v1
kind: Job
metadata:
  name: guest-register-shared-secret-ensure-1
  namespace: comms
spec:
  backoffLimit: 2
  template:
    spec:
      serviceAccountName: guest-register-secret-writer
      restartPolicy: OnFailure
      volumes:
        - name: work
          emptyDir: {}
      initContainers:
        - name: generate
          image: alpine:3.20
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -euo pipefail
              umask 077
              dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n' > /work/secret
              chmod 0644 /work/secret
          volumeMounts:
            - name: work
              mountPath: /work
      containers:
        - name: write
          image: bitnami/kubectl:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -euo pipefail
              if kubectl -n comms get secret guest-register-shared-secret-runtime >/dev/null 2>&1; then
                if kubectl -n comms get secret guest-register-shared-secret-runtime -o jsonpath='{.data.secret}' 2>/dev/null | grep -q .; then
                  exit 0
                fi
              else
                kubectl -n comms create secret generic guest-register-shared-secret-runtime \
                  --from-file=secret=/work/secret >/dev/null
                exit 0
              fi

              secret_b64="$(base64 /work/secret | tr -d '\n')"
              payload="$(printf '{\"data\":{\"secret\":\"%s\"}}' \"${secret_b64}\")"
              kubectl -n comms patch secret guest-register-shared-secret-runtime --type=merge -p \"${payload}\" >/dev/null
          volumeMounts:
            - name: work
              mountPath: /work