{{- if .Values.reconcile.enabled }}
{{- $fullname := include "aptly.fullname" . -}}
{{- $img := .Values.reconcile.image -}}
{{- $repo := $img.repository | default .Values.image.repository -}}
{{- $tag := $img.tag | default .Values.image.tag | default .Chart.AppVersion -}}
{{- $registry := .Values.global.imageRegistry -}}
{{- $image := ternary (printf "%s/%s:%s" $registry $repo $tag) (printf "%s:%s" $repo $tag) (ne $registry "") -}}
apiVersion: batch/v1
kind: Job
metadata:
  {{- if eq .Values.reconcile.mode "hook" }}
  name: {{ $fullname }}-reconcile
  annotations:
    helm.sh/hook: post-install,post-upgrade
    helm.sh/hook-weight: "5"
    # Deliberately no hook-failed: a failed Job stays around for `kubectl
    # logs`/`kubectl describe job` instead of vanishing before anyone can
    # read why reconciliation didn't converge.
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  {{- else }}
  # A plain (non-hook) Job named after the desired state's hash, for GitOps
  # controllers (ArgoCD/Flux) that reconcile hooks poorly: it only re-runs
  # when aptly.{gpgKeys,localRepos,mirrors,publish} actually change.
  name: {{ $fullname }}-reconcile-{{ dict "localRepos" .Values.aptly.localRepos "mirrors" .Values.aptly.mirrors "publish" .Values.aptly.publish | toYaml | sha256sum | trunc 8 }}
  {{- end }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
spec:
  backoffLimit: 3
  activeDeadlineSeconds: {{ mul .Values.reconcile.timeoutSeconds 2 }}
  {{- if ne .Values.reconcile.mode "hook" }}
  ttlSecondsAfterFinished: 86400
  {{- end }}
  template:
    metadata:
      labels:
        {{- include "aptly.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: reconcile
    spec:
      restartPolicy: Never
      {{- include "aptly.imagePullSecrets" . | nindent 6 }}
      {{- with include "aptly.serviceAccountName" . }}
      serviceAccountName: {{ . }}
      {{- end }}
      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: reconcile
          image: {{ $image }}
          imagePullPolicy: {{ $img.pullPolicy | default .Values.image.pullPolicy }}
          command: ["/usr/local/bin/aptly-reconcile"]
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          env:
            - name: APTLY_URL
              value: "http://{{ $fullname }}:{{ .Values.service.port }}"
            - name: APTLY_STATE_FILE
              value: /state.yaml
            - name: APTLY_FAIL_ON_ERROR
              value: {{ .Values.reconcile.failOnError | quote }}
            - name: APTLY_WAIT_TIMEOUT
              value: {{ .Values.reconcile.timeoutSeconds | quote }}
            {{- if .Values.security.auth.internalUser.enabled }}
            - name: APTLY_USER
              value: {{ .Values.security.auth.internalUser.username | quote }}
            - name: APTLY_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $fullname }}-credentials
                  key: internal-password
            {{- end }}
          volumeMounts:
            - name: state
              mountPath: /state.yaml
              subPath: state.yaml
              readOnly: true
            - name: tmp
              mountPath: /tmp
          resources:
            {{- toYaml .Values.reconcile.resources | nindent 12 }}
      volumes:
        - name: state
          configMap:
            name: {{ $fullname }}-state
        - name: tmp
          emptyDir: {}
{{- end }}