apiVersion: batch/v1
kind: Job
metadata:
  name: netbird-presync
  namespace: netbird
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: presync
          image: alpine/k8s:1.32.13
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== Netbird PreSync ==="

              # Set PodSecurity to privileged (cluster routers need NET_ADMIN)
              kubectl label namespace netbird pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true

              # Wait for CNPG cluster
              echo "Waiting for Netbird PostgreSQL cluster..."
              for i in $(seq 1 60); do
                PHASE=$(kubectl -n netbird get cluster pg-netbird -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
                  echo "  Netbird PostgreSQL cluster ready"
                  break
                fi
                echo "  waiting for pg-netbird... (attempt $i/60, phase=$PHASE)"
                sleep 5
              done

              # Wait for OAuth secret
              echo "Waiting for netbird-oauth-secret..."
              for i in $(seq 1 30); do
                if kubectl -n netbird get secret netbird-oauth-secret >/dev/null 2>&1; then
                  echo "  Netbird OAuth secret synced"
                  break
                fi
                echo "  waiting for ExternalSecret sync... (attempt $i/30)"
                sleep 2
              done

              echo "=== Netbird PreSync Complete ==="
      restartPolicy: Never