{{- if .Values.bootstrap.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: openbao-bootstrap
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "1"
    "helm.sh/hook-delete-policy": before-hook-creation
---
apiVersion: batch/v1
kind: Job
metadata:
  name: openbao-bootstrap
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "2"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: openbao-bootstrap
      restartPolicy: Never
      containers:
        - name: bootstrap
          image: {{ .Values.bootstrap.image }}
          env:
            - name: BAO_ADDR
              value: "http://{{ .Release.Name }}-openbao:8200"
            - name: BAO_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.bootstrap.rootTokenSecretName }}
                  key: {{ .Values.bootstrap.rootTokenSecretKey }}
          command:
            - sh
            - -ec
            - |
              echo "Enabling kv-v2 secrets engine at {{ .Values.eso.kvMountPath }} (if not already enabled)..."
              bao secrets enable -path={{ .Values.eso.kvMountPath }} kv-v2 || true

              echo "Enabling kubernetes auth method (if not already enabled)..."
              bao auth enable kubernetes || true

              echo "Configuring kubernetes auth method against the in-cluster API..."
              bao write auth/kubernetes/config \
                kubernetes_host="https://kubernetes.default.svc:443"

              echo "Writing eso-read policy..."
              cat <<EOF | bao policy write eso-read -
              path "{{ .Values.eso.kvMountPath }}/data/*" {
                capabilities = ["read"]
              }
              path "{{ .Values.eso.kvMountPath }}/metadata/*" {
                capabilities = ["list", "read"]
              }
              EOF

              echo "Binding role '{{ .Values.eso.roleName }}' to ServiceAccount {{ .Values.eso.namespace }}/{{ .Values.eso.serviceAccountName }}..."
              bao write auth/kubernetes/role/{{ .Values.eso.roleName }} \
                bound_service_account_names={{ .Values.eso.serviceAccountName }} \
                bound_service_account_namespaces={{ .Values.eso.namespace }} \
                policies=eso-read \
                ttl=1h

              echo "Bootstrap complete."
{{- end }}