{{- /*
Provisioning service GitHub-token Secret for franchised Sovereigns
(issue #866).

Why this template exists:
  The SME `provisioning` service Deployment references
  `secret/provisioning-github-token` with key `GITHUB_TOKEN` as a
  required env (provisioning.yaml). On contabo-mkt this Secret is
  pre-provisioned via SealedSecret. On a freshly franchised Sovereign
  nothing equivalent existed — caught live on otech103 (2026-05-04)
  where the provisioning Pod was the last 1/13 still in
  CreateContainerConfigError after #859 + #861 + #863 cleared the
  other 12 pods.

  This template materialises the Secret as part of the chart so any
  Sovereign that flips MARKETPLACE_ENABLED=true gets a working
  provisioning Pod out of the box, completing the SME stack
  (12/13 → 13/13 Running 1/1).

Approach (issue #866 Option C — local Gitea target):
  Post-cutover the canonical Git target on a Sovereign IS the local
  Gitea instance (the GitRepository CRs already point there), not
  upstream GitHub. So we mirror the Gitea admin password — already
  generated by platform/gitea/chart/templates/admin-secret.yaml with
  the same lookup-persistence pattern used here — into the `sme`
  namespace under the canonical key name `GITHUB_TOKEN` that the
  provisioning service reads. The env-var name stays GITHUB_TOKEN
  because the provisioning service code (core/services/provisioning/
  main.go) reads that exact env name; renaming it to GIT_TOKEN would
  ripple through provisioning.yaml + main.go + provisioning Go
  packages without changing behaviour.

  Per docs/INVIOLABLE-PRINCIPLES.md #3 (no workarounds): full Gitea
  REST-API target support in core/services/provisioning/github/
  client.go (which currently hardcodes https://api.github.com) is a
  separate follow-up. This Secret unblocks the Pod reaching Running
  1/1 — completing the SME stack — and gives the operator a valid
  credential to point the provisioning service at local Gitea via a
  per-Sovereign overlay env override (GITHUB_API_BASE_URL once that
  env knob lands; tracked in the same #866 follow-up).

Why not Reflector annotations on gitea-admin-secret?
  platform/gitea/chart/templates/admin-secret.yaml already carries
  reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "catalyst"
  — that is the deliberate mirror target for bp-self-sovereign-cutover
  Step 1's gitea-mirror Job, which reads the credentials from the
  catalyst namespace. Adding `sme` to that list would couple the
  gitea chart's mirror policy to a sister-product's deployment
  topology; the lookup-and-mirror pattern used here keeps the
  coupling local to bp-catalyst-platform (where it belongs) and
  matches the precedent set by valkey-cross-ns-secret.yaml (#863)
  and sme-secrets.yaml (#859). Reflector also reflects the entire
  source Secret bytes — we want only the password byte, exposed
  under the GITHUB_TOKEN key, not the full username+password pair.

First-install ordering:
  bp-gitea (slot 10) reaches Ready before bp-catalyst-platform (slot
  13) — the Flux dependsOn chain in clusters/_template/bootstrap-kit/
  13-bp-catalyst-platform.yaml lists bp-gitea explicitly. So by the
  time this template renders, gitea-admin-secret EXISTS in the gitea
  namespace and lookup returns its decoded password.

  In the rare degraded path where bp-gitea is mid-reconcile when this
  template runs (e.g. helm upgrade race), lookup may return nil —
  in that case this template renders no Secret, the provisioning Pod
  stays in CreateContainerConfigError, and Flux's 15m reconcile picks
  up the mirror once gitea-admin-secret exists. Provisioning Pod's
  restart-on-config-error backoff handles that gracefully (steady
  state is ~2-5 minutes after bp-gitea reaches Ready).

Per docs/INVIOLABLE-PRINCIPLES.md #10: NO plaintext credentials in this
template. The password lives only in gitea-admin-secret and is read
back via lookup; the bytes never appear in chart source or rendered
manifests on disk.

Per #4 (never hardcode): source/destination namespace + Secret names
flow through .Values.smeServices.provisioning.gitToken.* with sensible
defaults that match the upstream gitea + provisioning shapes.
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $sourceNamespace := .Values.smeServices.provisioning.gitToken.sourceNamespace | default "gitea" -}}
{{- $sourceSecretName := .Values.smeServices.provisioning.gitToken.sourceSecretName | default "gitea-admin-secret" -}}
{{- $sourcePasswordKey := .Values.smeServices.provisioning.gitToken.sourcePasswordKey | default "password" -}}
{{- $destNamespace := .Values.smeServices.provisioning.gitToken.destNamespace | default "sme" -}}
{{- $destSecretName := .Values.smeServices.provisioning.gitToken.destSecretName | default "provisioning-github-token" -}}
{{- $destKey := .Values.smeServices.provisioning.gitToken.destKey | default "GITHUB_TOKEN" -}}
{{- $sourceSecret := lookup "v1" "Secret" $sourceNamespace $sourceSecretName -}}
{{- if and $sourceSecret $sourceSecret.data (index $sourceSecret.data $sourcePasswordKey) -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $destSecretName }}
  namespace: {{ $destNamespace }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: provisioning-github-token
    app.kubernetes.io/part-of: sme
  annotations:
    # Identifies the upstream source for ops visibility — `kubectl describe
    # secret provisioning-github-token -n sme` makes the provenance obvious
    # without tribal knowledge.
    catalyst.openova.io/mirrored-from: {{ printf "%s/%s" $sourceNamespace $sourceSecretName | quote }}
    # Survive helm uninstall — the Secret outlives the release. A
    # subsequent helm install picks the bytes back up via lookup, so
    # the provisioning Pod stays Running across reinstalls without a
    # restart-storm.
    helm.sh/resource-policy: keep
type: Opaque
data:
  # Re-emit the gitea admin password verbatim under the env-name the
  # provisioning service reads. The provisioning service treats this
  # as a bearer token for whichever Git host it's pointed at via
  # GITHUB_OWNER + GITHUB_REPO + (future) GITHUB_API_BASE_URL.
  {{ $destKey }}: {{ index $sourceSecret.data $sourcePasswordKey | quote }}
{{- end }}
{{- end }}
