apiVersion: batch/v1
kind: Job
metadata:
  name: crowdsec-postsync
  namespace: crowdsec
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: postsync
          image: alpine/k8s:1.32.13
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== CrowdSec PostSync ==="

              # Wait for CrowdSec LAPI
              echo "Waiting for CrowdSec LAPI..."
              kubectl -n crowdsec rollout status deploy/crowdsec-lapi --timeout=180s 2>/dev/null || \
                echo "CrowdSec LAPI not ready yet"

              # Register firewall bouncer and store key in Vault
              LAPI_POD=$(kubectl -n crowdsec get pod -l app.kubernetes.io/name=crowdsec,app.kubernetes.io/component=lapi -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
              if [ -n "$LAPI_POD" ]; then
                ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' 2>/dev/null | base64 -d)
                EXISTING_KEY=""
                if [ -n "$ROOT_TOKEN" ]; then
                  EXISTING_KEY=$(kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
                    vault kv get -field=api-key secret/crowdsec-bouncer 2>/dev/null || echo "")
                fi

                if [ -z "$EXISTING_KEY" ]; then
                  echo "Registering firewall bouncer..."
                  BOUNCER_KEY=$(kubectl -n crowdsec exec "$LAPI_POD" -- cscli bouncers add firewall-bouncer -o raw 2>/dev/null || echo "")
                  if [ -n "$BOUNCER_KEY" ] && [ -n "$ROOT_TOKEN" ]; then
                    kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
                      vault kv put secret/crowdsec-bouncer api-key="$BOUNCER_KEY" 2>/dev/null && \
                      echo "  Bouncer API key stored in Vault"
                  fi
                else
                  echo "  Firewall bouncer key already in Vault"
                fi
              fi

              echo "=== CrowdSec PostSync Complete ==="
      restartPolicy: Never