apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-oauth-sync
  namespace: authentik
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "1"
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: oauth-sync
          image: bitnami/kubectl:latest
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== Authentik PostSync - OAuth Sync ==="

              echo "Waiting for Authentik server..."
              kubectl -n authentik rollout status deploy/authentik-server --timeout=600s

              echo "Waiting for Authentik worker..."
              kubectl -n authentik rollout status deploy/authentik-worker --timeout=300s

              echo "OAuth sync scripts should be run manually or via a separate automation."
              echo "Scripts are in the scripts/ directory of the Homelabv4 repo."
              echo "Run: bash scripts/sync-*-oauth.sh"

              echo "=== Authentik PostSync Complete ==="
      restartPolicy: Never