apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-presync
  namespace: authentik
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: presync
          image: bitnami/kubectl:1.29
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== Authentik PreSync ==="

              # Wait for CNPG cluster to be ready (applied by ArgoCD as sync-wave resource)
              echo "Waiting for Authentik PostgreSQL cluster..."
              for i in $(seq 1 60); do
                PHASE=$(kubectl -n authentik get clusters.postgresql.cnpg.io pg-authentik -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
                  echo "  PostgreSQL cluster ready"
                  break
                fi
                echo "  waiting for pg-authentik... (attempt $i/60, phase=$PHASE)"
                sleep 5
              done

              # Generate Authentik secret key if it doesn't exist
              if ! kubectl -n authentik get secret authentik >/dev/null 2>&1; then
                echo "Generating Authentik secret key..."
                SECRET_KEY=$(openssl rand -hex 50)
                kubectl -n authentik create secret generic authentik \
                  --from-literal=AUTHENTIK_SECRET_KEY="$SECRET_KEY"
                echo "  Authentik secret key generated"
              else
                echo "  Authentik secret already exists"
              fi

              echo "=== Authentik PreSync Complete ==="
      restartPolicy: Never