apiVersion: batch/v1
kind: Job
metadata:
  name: crowdsec-presync
  namespace: crowdsec
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: presync
          image: alpine/k8s:1.32.13
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              echo "=== CrowdSec PreSync ==="

              # Set PodSecurity to privileged (firewall bouncer needs host access)
              kubectl label namespace crowdsec pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true

              # Wait for CNPG cluster
              echo "Waiting for CrowdSec PostgreSQL cluster..."
              for i in $(seq 1 60); do
                PHASE=$(kubectl -n crowdsec get clusters.postgresql.cnpg.io pg-crowdsec -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
                  echo "  CrowdSec PostgreSQL cluster ready"
                  break
                fi
                echo "  waiting for pg-crowdsec... (attempt $i/60, phase=$PHASE)"
                sleep 5
              done

              echo "=== CrowdSec PreSync Complete ==="
      restartPolicy: Never