apiVersion: batch/v1
kind: Job
metadata:
  name: istio-mesh-infra-enrollment
  namespace: istio-system
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "1"
spec:
  backoffLimit: 3
  ttlSecondsAfterFinished: 300
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      restartPolicy: Never
      containers:
        - name: enroll
          image: bitnami/kubectl:1.29
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== Enrolling infrastructure namespaces in Istio ambient mesh ==="

              # Enroll infrastructure namespaces
              # Excluded: vault (Shamir seal requires manual unseal after restart)
              # Excluded: kube-system, istio-system, cert-manager, kyverno (system namespaces)
              INFRA_NAMESPACES=(authentik cnpg-system redis-operator mariadb-system prometheus external-dns grafana mqtt unpoller netbird default gateway scylla-manager crowdsec)
              for ns in "${INFRA_NAMESPACES[@]}"; do
                echo "Enrolling $ns in ambient mesh..."
                kubectl label namespace "$ns" istio.io/dataplane-mode=ambient --overwrite 2>/dev/null || true
                kubectl label namespace "$ns" istio-injection- 2>/dev/null || true
              done

              # Attach waypoint proxies for L7 policy enforcement
              echo "Attaching waypoint proxies to infrastructure namespaces..."
              WAYPOINT_NAMESPACES=(authentik external-dns grafana mqtt unpoller netbird prometheus scylla-manager crowdsec)
              for ns in "${WAYPOINT_NAMESPACES[@]}"; do
                kubectl label namespace "$ns" istio.io/use-waypoint=waypoint --overwrite 2>/dev/null || true
              done

              # Deploy ext_authz Host-rewriting proxy for Authentik
              if [ -f /tmp/ext-authz-proxy.yaml ]; then
                kubectl apply -f /tmp/ext-authz-proxy.yaml
              fi

              echo "Infrastructure namespace enrollment complete"