{{- /*
PowerDNS REST API + webserver credentials.

Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) + #10 (credential
hygiene) we MUST never bake plaintext credentials into the chart, BUT we
also MUST give a freshly-installed Sovereign a way to bring its own
PowerDNS up without out-of-band ceremony — a Sovereign that bootstraps
itself from bp-* OCI artifacts has no operator standing by to inject a
Secret while Helm is mid-install.

The pattern below mirrors bitnami/postgresql, bitnami/keycloak, and the
upstream redis chart: on FIRST install, generate a 32-char random api-key
and 32-char random webserver-password and persist them in the Secret. On
every subsequent reconcile, `lookup` returns the existing Secret and we
re-emit the SAME values — no rotation on upgrade, no drift, no chicken-
and-egg with the deployment.

The Secret is created BEFORE the Deployment in Helm's normal install
order (alphabetical by kind: Secret < Deployment), so the powerdns pods
find their `powerdns-api-credentials` Secret on first start instead of
sitting in CreateContainerConfigError forever (which is what 1.1.2 did
on otech.omani.works — see PR fixing this).

Operator override:
  - Set `.Values.powerdns.apiKey` and `.Values.powerdns.webserverPassword`
    in the cluster overlay to inject specific values (e.g. when a
    sealed-secret already pins them).
  - Set `.Values.powerdns.useExistingApiSecret: true` to skip Secret
    creation entirely and rely on a Secret named `powerdns-api-credentials`
    already present in the namespace (created by an out-of-band
    ExternalSecret / SealedSecret / etc).
*/}}
{{- if not .Values.powerdns.useExistingApiSecret }}
{{- $secretName := "powerdns-api-credentials" -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $apiKey := "" -}}
{{- $webPass := "" -}}
{{- if $existing -}}
  {{- /* Reuse what's already there — never rotate on upgrade. */ -}}
  {{- $apiKey = index $existing.data "api-key" | b64dec -}}
  {{- $webPass = index $existing.data "webserver-password" | b64dec -}}
{{- end -}}
{{- /* Operator-supplied values win over both lookup and randAlphaNum. */ -}}
{{- if .Values.powerdns.apiKey -}}
  {{- $apiKey = .Values.powerdns.apiKey -}}
{{- end -}}
{{- if .Values.powerdns.webserverPassword -}}
  {{- $webPass = .Values.powerdns.webserverPassword -}}
{{- end -}}
{{- /* Fall back to fresh randoms only when neither lookup nor operator
       provided a value (i.e. genuine first install). 32 chars from the
       alphanum set per INVIOLABLE-PRINCIPLES #10 (>= 24 chars, no
       dictionary words). */ -}}
{{- if not $apiKey -}}
  {{- $apiKey = randAlphaNum 32 -}}
{{- end -}}
{{- if not $webPass -}}
  {{- $webPass = randAlphaNum 32 -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-powerdns.labels" . | nindent 4 }}
  annotations:
    catalyst.openova.io/comment: |
      Generated on first install via helm `lookup` + `randAlphaNum`. On
      every subsequent reconcile the existing values are read back so the
      Secret is stable across upgrades. Operator may override via
      .Values.powerdns.apiKey / .Values.powerdns.webserverPassword in the
      cluster overlay.
    # Reflector cross-namespace mirror annotations (issue #544 + PR
    # #681 followup).
    # - bp-external-dns reads this Secret in the `external-dns` ns.
    # - On contabo, catalyst-api reads it in the `catalyst` ns as env
    #   CATALYST_POWERDNS_API_KEY so the Sovereign provisioner can
    #   stamp it into the cloud-init template (target: Sovereign-side
    #   `cert-manager/powerdns-api-credentials` Secret consumed by
    #   bp-cert-manager-powerdns-webhook for DNS-01 challenges).
    # Reflector (bp-reflector, slot 05a) propagates the Secret
    # automatically so no manual copy-paste is required. Allowed
    # / auto-namespaces are comma-separated; add more if other
    # blueprints need the API key.
    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "external-dns,catalyst"
    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
    reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "external-dns,catalyst"
type: Opaque
stringData:
  api-key: {{ $apiKey | quote }}
  webserver-password: {{ $webPass | quote }}
{{- end }}
