{{- if .Values.kubernetesAPI.enabled }}
{{- $routerNS := .Release.Namespace }}
{{- if .Values.namespacedNetworks }}
{{- $routerNS = "default" }}
{{- end }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "netbird-operator-config.fullname" . }}-kubernetes-service-expose
  labels:
    app.kubernetes.io/component: operator
    {{- include "netbird-operator-config.labels" . | nindent 4 }}
  annotations:
    helm.sh/hook: post-upgrade,post-install
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
spec:
  backoffLimit: 3
  template:
    metadata:
      name: {{ include "netbird-operator-config.fullname" . }}
      labels:
        app.kubernetes.io/component: operator
        {{- include "netbird-operator-config.labels" . | nindent 8 }}
    spec:
      initContainers:
      - name: wait-network-ready
        image: "netbirdio/kubectl:latest"
        command:
        - sh
        - -c
        args:
        - kubectl wait --for 'jsonpath={.status.networkID}' -n {{ $routerNS }} nbroutingpeer router;
      containers:
      - name: apply-nbresource
        image: "netbirdio/kubectl:latest"
        env:
        - name: NBRESOURCE_VALUE
          value: |
            apiVersion: netbird.io/v1
            kind: NBResource
            metadata:
              finalizers:
              - netbird.io/cleanup
              name: kubernetes
              namespace: default
            spec:
              address: kubernetes.default.{{.Values.cluster.dns}}
              groups:
              {{- if .Values.kubernetesAPI.groups }}
              {{ toYaml .Values.kubernetesAPI.groups }}
              {{- else }}
              - {{ .Values.cluster.name }}-default-api-access
              {{- end }}
              name: {{ .Values.kubernetesAPI.resourceName | default "default-kubernetes-api" }}
              networkID: ${NETWORK_ID}
              {{- if .Values.kubernetesAPI.policies }}
              policyName: "{{ join "," .Values.kubernetesAPI.policies }}"
              {{- end }}
              tcpPorts:
              - 443
        command:
        - sh
        - -c
        args:
        - kubectl delete NBResource --ignore-not-found -n default kubernetes; export NETWORK_ID=$(kubectl get NBRoutingPeer -n {{ $routerNS }} router -o 'jsonpath={.status.networkID}'); echo "$NBRESOURCE_VALUE" | envsubst | kubectl apply -f -
      serviceAccountName: {{ include "netbird-operator-config.serviceAccountName" . }}
      restartPolicy: Never
{{- end }}