{{- if .Values.externalSecrets.enabled }}
{{- $fullname := (include "k8s.serviceFullname" .) }}
{{- $externalSecretStoreName := (include "external-secrets.secretStoreName" .) }}
{{- $labels := (include "k8s.labels" .) | fromJson }}
{{- $externalSecretName := (include "external-secrets.externalSecretName" .) }}
---
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: {{ $externalSecretStoreName }}
  labels:
  {{- range $key, $value := $labels }}
    {{ $key }}: {{ $value }}
  {{- end }}
  annotations:
    helm.sh/hook: "pre-install, pre-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
    helm.sh/hook-weight: "-2"
spec:
  provider:
    vault:
      server: {{ include "external-secrets.secretStoreAddress" . }}
      path: "secret"
      version: "v2"
      auth:
        # Authenticate against Vault using a Kubernetes ServiceAccount
        # token stored in a Secret.
        # https://www.vaultproject.io/docs/auth/kubernetes
        kubernetes:
          # Path where the Kubernetes authentication backend is mounted in Vault
          mountPath: {{ .Values.externalSecrets.secretStore.mountPath | default (include "aws.eksClusterName" .) }}
          # A required field containing the Vault Role to assume.
          role: {{ .Values.externalSecrets.secretStore.vaultRole | default "default-service-role" }}
          # Optional service account field containing the name
          # of a kubernetes ServiceAccount
          serviceAccountRef:
            name: {{ include "k8s.serviceAccountName" . }}

{{- if and (empty .Values.externalSecrets.secret.secretVariables) (empty .Values.externalSecrets.secret.secretVariablesFrom) (empty .Values.externalSecrets.secret.secrets) }}
{{ required "externalSecrets.secret: must define either secretVariables (data) and/or secretVariablesFrom (dataFrom) and/or secrets (data and/or dataFrom)" "" }}
{{- end }}

{{- if or .Values.externalSecrets.secret.secretVariables .Values.externalSecrets.secret.secretVariablesFrom }}
{{- if and (empty .Values.externalSecrets.secret.secretVariables) (empty .Values.externalSecrets.secret.secretVariablesFrom) }}
{{ required "externalSecrets.secret: must define either secretVariables (data) and/or secretVariablesFrom (dataFrom)" "" }}
{{- end }}
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name:  {{ $externalSecretName }}
  labels:
  {{- range $key, $value := $labels }}
    {{ $key }}: {{ $value }}
  {{- end }}
  annotations:
    helm.sh/hook: "pre-install, pre-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
    helm.sh/hook-weight: "-1"
spec:
  refreshInterval: {{ .Values.externalSecrets.secret.refreshInterval | default "10m" }}
  secretStoreRef:
    name: {{ $externalSecretStoreName }}
    kind: SecretStore
  target:
    name: {{ include "k8s.secretName" . }}
    creationPolicy: Owner
  {{- with .Values.externalSecrets.secret.secretVariables }}
  data:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with .Values.externalSecrets.secret.secretVariablesFrom }}
  dataFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}

{{- if .Values.externalSecrets.secret.secrets }}
{{- range $secret := .Values.externalSecrets.secret.secrets }}
{{- if and (empty $secret.secretVariables) (empty $secret.secretVariablesFrom) }}
{{ required "externalSecrets.secret.secrets: must define either secretVariables (data) and/or secretVariablesFrom (dataFrom)" "" }}
{{- end }}
{{- $secretNameSuffix := $secret.secretNameSuffix | required "secret[].secretNameSuffix required!" }}
{{- $targetName := (cat "secret." $fullname "-" $secretNameSuffix | nospace) }}
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: {{ $externalSecretName }}-{{ $secretNameSuffix }}
  labels:
  {{- range $key, $value := $labels }}
    {{ $key }}: {{ $value }}
  {{- end }}
  annotations:
    helm.sh/hook: "pre-install, pre-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
    helm.sh/hook-weight: "-1"
spec:
  refreshInterval: {{ $secret.refreshInterval | default "10m" }}
  secretStoreRef:
    name: {{ $externalSecretStoreName }}
    kind: SecretStore
  target:
    name: {{ $targetName }}
    creationPolicy: Owner
  {{- with $secret.secretVariables }}
  data:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with $secret.secretVariablesFrom }}
  dataFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}
{{- end }}
{{- end }}