apiVersion: batch/v1
kind: Job
metadata:
  name: vault-eso-bootstrap
  namespace: vault
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "2"
spec:
  backoffLimit: 5
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: eso-bootstrap
          image: bitnami/kubectl:latest
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== Vault ESO Bootstrap ==="

              # Wait for ESO to be ready
              echo "Waiting for External Secrets Operator..."
              for i in $(seq 1 60); do
                if kubectl -n external-secrets get deploy/external-secrets >/dev/null 2>&1; then
                  kubectl -n external-secrets rollout status deploy/external-secrets --timeout=180s && break
                fi
                echo "  waiting for ESO deployment... (attempt $i/60)"
                sleep 5
              done

              # Wait for ClusterSecretStore to be ready
              echo "Checking ClusterSecretStore vault-backend..."
              for i in $(seq 1 30); do
                STATUS=$(kubectl get clustersecretstore vault-backend -o jsonpath='{.status.conditions[0].status}' 2>/dev/null || echo "")
                if [ "$STATUS" = "True" ]; then
                  echo "  ClusterSecretStore vault-backend is ready"
                  break
                fi
                echo "  waiting for ClusterSecretStore... (attempt $i/30)"
                sleep 5
              done

              echo "=== Vault ESO Bootstrap Complete ==="
      restartPolicy: Never