{{- /*
Cross-namespace mirror of bp-valkey's auto-generated auth Secret (issue
#863).

Why this template exists:
  bp-valkey 1.0.0 (Catalyst Blueprint slot 17) ships with
  `auth.enabled=true` (bitnami valkey 5.5.1 default). The bitnami subchart
  auto-generates a random password on first install and exposes it via
  the `valkey-password` key in the `valkey` Secret in the `valkey`
  namespace. SME services (auth + gateway) consume this Valkey
  cross-namespace from the `sme` namespace; without the password they
  hit "NOAUTH HELLO must be called with the client already authenticated"
  on every connect attempt.

  This template uses Helm `lookup` to read the bp-valkey password at
  reconcile time and re-emit it as a Secret named `sme-valkey-auth` in
  the `sme` namespace. The auth + gateway Deployments (auth.yaml /
  gateway.yaml) wire VALKEY_PASSWORD via secretKeyRef.

Why not Reflector annotations on the bp-valkey Secret?
  Reflector requires the SOURCE Secret to carry mirror annotations.
  bp-valkey 1.0.0 doesn't expose a values-knob to add annotations to
  the auto-generated `valkey` Secret (bitnami chart 5.5.1 doesn't
  support annotation injection on internal-credentials Secrets).
  Forking the upstream chart to inject annotations would couple this
  fix to a bp-valkey rebuild + slot 17 lockstep — substantially more
  blast radius for a one-line problem. The lookup-and-mirror pattern
  used here is identical to the one already used by sme-secrets.yaml
  (issue #859) and gitea-admin-secret (issue #830 Bug 2).

First-install ordering:
  bp-valkey (slot 17) and bp-catalyst-platform (slot 13) install in
  parallel under Flux. There is NO explicit dependsOn from slot 13 →
  slot 17 today (Catalyst-platform's umbrella Helm install does not
  require Valkey to be Ready). On first install the lookup MAY return
  nil — in that case this template renders no Secret, and a subsequent
  reconcile (Flux's 15m default) finds the bp-valkey Secret and emits
  the mirrored copy.

  The two SME services that consume Valkey (auth + gateway) will
  CrashLoopBackOff until the mirror appears, but Kubernetes' restart
  backoff handles that gracefully (steady state is ~2-5 minutes after
  bp-valkey reaches Ready).

Per docs/INVIOLABLE-PRINCIPLES.md #10: NO plaintext credentials in this
template. The password lives only in the bp-valkey Secret and is read
back via lookup; the bytes never appear in chart source or rendered
manifests on disk.

Per #4 (never hardcode): source/destination namespace + Secret names
flow through .Values.smeServices.valkey.* with sensible defaults.
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $sourceNamespace := .Values.smeServices.valkey.namespace | default "valkey" -}}
{{- $sourceSecretName := .Values.smeServices.valkey.sourceSecretName | default "valkey" -}}
{{- $sourcePasswordKey := .Values.smeServices.valkey.sourcePasswordKey | default "valkey-password" -}}
{{- $destNamespace := .Values.smeServices.valkey.destNamespace | default "sme" -}}
{{- $destSecretName := .Values.smeServices.valkey.destSecretName | default "sme-valkey-auth" -}}
{{- $sourceSecret := lookup "v1" "Secret" $sourceNamespace $sourceSecretName -}}
{{- if and $sourceSecret $sourceSecret.data (index $sourceSecret.data $sourcePasswordKey) -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $destSecretName }}
  namespace: {{ $destNamespace }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: valkey-cross-ns-mirror
    app.kubernetes.io/part-of: sme
  annotations:
    # Identifies the upstream source for ops visibility — `kubectl describe
    # secret sme-valkey-auth -n sme` makes the provenance obvious without
    # tribal knowledge.
    catalyst.openova.io/mirrored-from: {{ printf "%s/%s" $sourceNamespace $sourceSecretName | quote }}
    helm.sh/resource-policy: keep
type: Opaque
data:
  # Re-emit the password verbatim. valkey-go's ClientOption.Password
  # field is the canonical wire — bitnami valkey's `requirepass` uses
  # the implicit `default` ACL user, so VALKEY_USERNAME is empty by
  # convention (auth.yaml + gateway.yaml don't set it explicitly).
  valkey-password: {{ index $sourceSecret.data $sourcePasswordKey | quote }}
{{- end }}
{{- end }}
