apiVersion: batch/v1
kind: Job
metadata:
  name: keycloak-client-sync
  annotations:
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
    argocd.argoproj.io/sync-wave: "4"
spec:
  activeDeadlineSeconds: 600
  backoffLimit: 1
  template:
    metadata:
      labels:
        app: keycloak-client-sync
    spec:
      serviceAccountName: keycloak-client-sync
      automountServiceAccountToken: false
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: keycloak-client-sync
          image: quay.io/keycloak/keycloak:26.5.5@sha256:a7b0cb7a43a1235a61872883414d3f1d9a3ceac9df6e5907bd12202778a6265c
          command:
            - /bin/sh
            - -c
            - |
              set -eu

              ready=false
              for _ in $(seq 1 60); do
                if /opt/keycloak/bin/kcadm.sh config credentials \
                  --server http://keycloak \
                  --realm master \
                  --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
                  --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; then
                  ready=true
                  break
                fi
                sleep 5
              done
              test "$ready" = true

              CLIENT_UUID=$(/opt/keycloak/bin/kcadm.sh get clients \
                -r project-auth \
                -q clientId="$KEYCLOAK_CLIENT_ID" | sed -n 's/.*"id" : "\([^"]*\)".*/\1/p' | head -n 1)

              test -n "$CLIENT_UUID"

              /opt/keycloak/bin/kcadm.sh update "clients/${CLIENT_UUID}" \
                -r project-auth \
                -s "secret=$KEYCLOAK_CLIENT_SECRET" \
                -s "baseUrl=$AUTH_SERVER_BASE_URL" \
                -s 'redirectUris=["'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-google","'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-github"]' \
                -s 'webOrigins=["'"$AUTH_SERVER_BASE_URL"'"]'
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          env:
            - name: KC_BOOTSTRAP_ADMIN_USERNAME
              valueFrom:
                configMapKeyRef:
                  name: auth-system-config
                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: keycloak-bootstrap-admin
                  key: KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD
            - name: KEYCLOAK_CLIENT_ID
              valueFrom:
                configMapKeyRef:
                  name: auth-system-config
                  key: KEYCLOAK_CLIENT_ID
            - name: KEYCLOAK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: keycloak-client-auth-server
                  key: KEYCLOAK_CLIENT_SECRET
            - name: AUTH_SERVER_BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: auth-system-config
                  key: AUTH_SERVER_BASE_URL