# grafana_charts_provisioner-job.yaml
{{- if and .Values.provisioner.enabled .Values.enterprise.enabled -}}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "tempo.resourceName" (dict "ctx" . "component" "provisioner") }}
  labels:
    {{- include "tempo.labels" (dict "ctx" . "component" "provisioner") | nindent 4 }}
    {{- with .Values.provisioner.labels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  annotations:
    {{- with .Values.provisioner.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
    "helm.sh/hook": "{{ .Values.provisioner.hookType }}"
    "helm.sh/hook-weight": "20"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
  namespace: {{ .Release.Namespace | quote }}
spec:
  backoffLimit: 6
  completions: 1
  parallelism: 1
  selector:
  template:
    metadata:
      labels:
        {{- include "tempo.podLabels" (dict "ctx" . "component" "provisioner") | nindent 8 }}
      annotations:
        {{- include "tempo.podAnnotations" (dict "ctx" . "component" "provisioner") | nindent 8 }}
      namespace: {{ .Release.Namespace | quote }}
    spec:
      serviceAccountName: {{ include "tempo.resourceName" (dict "ctx" . "component" "provisioner") }}
      {{- if .Values.provisioner.priorityClassName }}
      priorityClassName: {{ .Values.provisioner.priorityClassName }}
      {{- end }}
      securityContext:
        {{- toYaml .Values.provisioner.securityContext | nindent 8 }}
      {{- if .Values.tempo.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.tempo.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      initContainers:
        - name: provisioner
          image: "{{ $.Values.provisioner.image.registry }}/{{ $.Values.provisioner.image.repository }}:{{ $.Values.provisioner.image.tag }}"
          imagePullPolicy: {{ $.Values.provisioner.image.pullPolicy }}
          command:
            - /bin/sh
            - -euc
            - |
              {{- range $tenant := .Values.provisioner.additionalTenants }}
              /usr/bin/provisioner \
                -bootstrap-path=/bootstrap \
                -cluster-name={{ include "tempo.clusterName" $ }} \
                -api-url={{ $.Values.provisioner.apiUrl }} \
                -tenant={{ $tenant.name }} \
                -access-policy=write-{{ $tenant.name }}:{{ $tenant.name }}:traces:write \
                -access-policy=read-{{ $tenant.name }}:{{ $tenant.name }}:traces:read \
                -token=write-{{ $tenant.name }} \
                -token=read-{{ $tenant.name }}
                {{- range $flag, $value := $.Values.provisioner.extraArgs }}
                - -{{ $flag }}={{ $value }}
                {{- end }}
              {{- end }}
          volumeMounts:
            {{- if $.Values.provisioner.extraVolumeMounts }}
              {{ toYaml $.Values.provisioner.extraVolumeMounts | nindent 12 }}
            {{- end }}
            {{- if $.Values.global.extraVolumeMounts }}
              {{ toYaml $.Values.global.extraVolumeMounts | nindent 12 }}
            {{- end }}
            - name: bootstrap
              mountPath: /bootstrap
            - name: admin-token
              mountPath: /bootstrap/token
              subPath: token
          {{- with $.Values.provisioner.env }}
          env:
            {{ toYaml . | nindent 12 }}
          {{- end }}
      containers:
        - name: create-secret
          image: {{ .Values.kubectlImage.repository }}:{{ .Values.kubectlImage.tag }}
          imagePullPolicy: {{ .Values.kubectlImage.pullPolicy | default "IfNotPresent" }}
          command:
            - /bin/sh
            - -exuc
            - |
              # In this case, the admin resources have already been created, the provisioner job
              # does not write the token files to the bootstrap mount.
              # Therefore, secrets are only created if the respective token files exist.
              # Note: the following bash commands should always return a success status code. 
              # Therefore, in case the token file does not exist, the first clause of the 
              # or-operation is successful.
              {{- $secretPrefix := .Values.provisioner.provisionedSecretPrefix | default (include "tempo.resourceName" (dict "ctx" . "component" "token")) }}
              {{- range .Values.provisioner.additionalTenants }}
              ! test -s /bootstrap/token-write-{{ .name }} || \
                kubectl --namespace "{{ .secretNamespace }}" create secret generic "{{ $secretPrefix }}-{{ .name }}" \
                  --from-literal=token-write="$(cat /bootstrap/token-write-{{ .name }})" \
                  --from-literal=token-read="$(cat /bootstrap/token-read-{{ .name }})"
              {{- end }}
          volumeMounts:
            - name: bootstrap
              mountPath: /bootstrap
      {{- with .Values.provisioner.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.provisioner.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.provisioner.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      restartPolicy: OnFailure
      volumes:
        - name: admin-token
          secret:
            secretName: {{ .Values.tokengenJob.adminTokenSecret }}
        - name: bootstrap
          emptyDir: {}
        {{- if .Values.provisioner.extraVolumes }}
        {{- toYaml .Values.provisioner.extraVolumes | nindent 8 }}
        {{- end }}
        {{- if .Values.global.extraVolumes }}
        {{- toYaml .Values.global.extraVolumes | nindent 8 }}
        {{- end }}
{{- end -}}