{{- /*
Catalyst-curated admin credentials Secret for the Gitea admin user.

Contract (issue #830 Bug 2):
  - Name: `gitea-admin-secret` (per .Values.giteaAdmin.secretName, default).
  - Namespace: this chart's release namespace (the `gitea` namespace by
    convention on Sovereigns + Catalyst-Zero).
  - Keys: `username` + `password`. Both are bytes the upstream Gitea chart
    reads via `gitea.admin.existingSecret` (init.yaml's GITEA_ADMIN_USERNAME
    and GITEA_ADMIN_PASSWORD env are valueFrom this Secret).
  - The same Secret is consumed by bp-self-sovereign-cutover Step 1
    (gitea-mirror): the cutover handler stamps a Job from
    cutover-step-01-gitea-mirror PodSpec which references
    `gitea.adminSecretRef.name = gitea-admin-secret` with
    `usernameKey = username` + `passwordKey = password`. See
    platform/self-sovereign-cutover/chart/values.yaml.

Why ONE Secret with `username` + `password` (not two separate keys, not
a re-derive from `r8sA8CPHD9!bt6d`):
  - feedback_passwords.md mandates fully-random 24+ char passwords on
    every install. The upstream chart's hardcoded default password would
    ship the SAME credentials to every Sovereign — credential hygiene
    catastrophe. We MUST generate per-install.
  - Single Secret with the canonical `username`/`password` shape is the
    contract bp-self-sovereign-cutover Step 1 was authored against. A
    different shape would force a chart-side adapter Pod (extra moving
    part, extra failure mode) for no benefit.

Persistence across reconciles (the load-bearing piece):
  - On first install, `lookup` returns nil → `randAlphaNum 32` generates
    a fresh password.
  - On every subsequent reconcile, `lookup` finds the existing Secret on
    the cluster, decodes the existing password, and re-encodes it
    verbatim. The bytes are STABLE across helm upgrade, helm rollback,
    and Flux re-reconciliation.
  - Without `lookup`, every reconcile would emit a NEW password and
    Gitea's init container's password-sync (passwordMode=keepUpdated)
    would happily rewrite the user's auth on each tick — breaking every
    long-running session and every running cutover Step 1 Job.
  - `helm.sh/resource-policy: keep` is belt-and-braces: even if someone
    runs `helm uninstall` the Secret survives so a re-install picks the
    same password back up via lookup.

Per docs/INVIOLABLE-PRINCIPLES.md #10: NO plaintext default credentials
in this template. The first-install random is generated by sprig's
randAlphaNum, never echoed, and lives only in the Secret bytes.

Per #4 (never hardcode): username is overrideable via
`.Values.giteaAdmin.username`; default is `gitea_admin` matching the
existing values.yaml + upstream init.yaml expectations.
*/ -}}
{{- $secretName := .Values.giteaAdmin.secretName | default "gitea-admin-secret" -}}
{{- $username := .Values.giteaAdmin.username | default "gitea_admin" -}}
{{- /* Look up an existing Secret of the same name to preserve the
       password across reconciles. lookup returns nil on first install
       OR when running `helm template` outside a cluster (the smoke-
       render path) — in either case we generate a fresh one. */ -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $password := "" -}}
{{- if and $existing $existing.data $existing.data.password -}}
  {{- /* Preserve the bytes: decode the b64 then we re-encode below.
         This branch is the steady-state — every reconcile after the
         first lands here. */ -}}
  {{- $password = $existing.data.password | b64dec -}}
{{- else -}}
  {{- /* First install (or smoke-render): generate a 32-char alphanum
         password. randAlphaNum is sprig's deterministic-from-template-
         seed RNG; on a real install that runs once and the lookup
         branch wins forever after. Per feedback_passwords.md the 32
         chars + alphanum-only is sufficient entropy (190 bits).
         Punctuation is omitted because the upstream init.yaml passes
         the password as a positional CLI arg to `gitea admin user
         create` and shell escaping is fragile across busybox/alpine/
         distroless — alphanum is safe everywhere. */ -}}
  {{- $password = randAlphaNum 32 -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ .Release.Namespace }}
  labels:
    catalyst.openova.io/blueprint: bp-gitea
    catalyst.openova.io/component: gitea-admin
    app.kubernetes.io/name: gitea
    app.kubernetes.io/component: admin-credentials
  annotations:
    # Survive helm uninstall — the Secret outlives the release. A
    # subsequent helm install picks up the bytes via lookup.
    helm.sh/resource-policy: keep
    # bp-reflector mirrors this Secret into the namespaces listed below
    # so cross-namespace consumers (bp-self-sovereign-cutover Step 1
    # gitea-mirror Job in the catalyst namespace) can mount the same
    # credentials without a cross-namespace secretKeyRef (which K8s
    # forbids). reflector keeps the mirror in lockstep on every change.
    # See https://github.com/emberstack/kubernetes-reflector.
    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "catalyst"
    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "catalyst"
type: Opaque
data:
  username: {{ $username | b64enc | quote }}
  password: {{ $password | b64enc | quote }}
