resource "kubernetes_service_account" "cert_checker" {
  metadata {
    name      = "cert-checker-sa"
    namespace = var.namespace
  }
}

resource "kubernetes_role" "cert_checker" {
  metadata {
    name = "cert-checker-role"
  }
  rule {
    api_groups = ["apps"]
    resources  = ["deployments"]
    verbs      = ["get", "list", "patch", "update"]
  }
}

resource "kubernetes_role_binding" "cert_checker_auth_reader" {
  metadata {
    name      = "cert-checker-biding"
    namespace = var.namespace
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = "cert-checker-role"
  }
  subject {
    kind      = "ServiceAccount"
    name      = "cert-checker-sa"
    namespace = var.namespace
  }
}

resource "kubernetes_config_map" "cert_checker" {
  metadata {
    name      = "cert-checker-config"
    namespace = var.namespace
  }
  data = {
    "check.py"         = file("${path.module}/resources/check.py")
    "requirements.txt" = file("${path.module}/resources/requirements.txt")
  }
}

resource "kubernetes_cron_job_v1" "cert_checker" {
  for_each = var.deployments
  metadata {
    name      = "cert-checker-${each.key}"
    namespace = var.namespace
    labels = {
      app = "cert-checker"
    }
  }
  spec {
    schedule                      = coalesce(each.value.schedule, "0 0 * * *") # Default to daily at midnight
    successful_jobs_history_limit = 2
    failed_jobs_history_limit     = 1

    job_template {
      metadata {
        name = "cert-checker"
      }
      spec {
        backoff_limit = 1
        parallelism   = 1
        completions   = 1

        template {
          metadata {
            labels = {
              app = "cert-checker"
            }
          }
          spec {
            service_account_name = kubernetes_service_account.cert_checker.metadata[0].name
            restart_policy       = "Never"
            container {
              name    = "cert-checker"
              image   = var.tag
              command = ["sh", "-c", join(" && ", local.commands)]
              volume_mount {
                name       = "config-volume"
                mount_path = "/config"
                read_only  = true
              }
              volume_mount {
                name       = "cert-volume"
                mount_path = "/certs"
                read_only  = true
              }
              volume_mount {
                name       = "workdir"
                mount_path = "/tmp"
              }
              security_context {
                run_as_user                = 1000
                run_as_group               = 1000
                allow_privilege_escalation = false
                read_only_root_filesystem  = true
                run_as_non_root            = true
                capabilities {
                  drop = ["ALL"]
                }
              }
              env {
                name  = "DEPLOYMENT_NAME"
                value = each.key
              }
              env {
                name  = "NAMESPACE"
                value = var.namespace
              }
              env {
                name  = "SERVICE_HOST"
                value = "${each.value.service_name}.${var.namespace}.svc.cluster.local"
              }
              env {
                name  = "SERVICE_PORT"
                value = tostring(each.value.service_port)
              }
            }
            volume {
              name = "config-volume"
              config_map {
                name = kubernetes_config_map.cert_checker.metadata[0].name
              }
            }
            volume {
              name = "cert-volume"
              secret {
                secret_name = each.value.secret_name
              }
            }
            volume {
              name = "workdir"
              host_path {
                path = local.workdir
                type = "DirectoryOrCreate"
              }
            }
          }
        }
      }
    }
  }
}