{{/* Checks for `catalog.ingress.path` */}}
{{- if .Values.catalog.ingress.path }}
  {{- if not (.Values.catalog.ingress.path | hasPrefix "/") }}
  {{ required "The `catalog.ingress.path` should start with a '/'!" nil }}
  {{- end }}
  {{- if and (ne .Values.catalog.ingress.path "/") (.Values.catalog.ingress.path | hasSuffix "/") }}
  {{ required "The `catalog.ingress.path` should NOT include a trailing '/'!" nil }}
  {{- end }}
{{- end }}

apiVersion: v1
kind: Secret
metadata:
  name: {{ include "iceberg-catalog.fullname" . }}-config-envs
  labels:
    {{- include "iceberg-catalog.labels" . | nindent 4 }}
    app.kubernetes.io/component: config
data:
  # Database Configs
  {{- if not .Values.postgresql.enabled }}
  {{- if .Values.externalDatabase.host_read }}
  LAKEKEEPER__PG_HOST_R: {{ .Values.externalDatabase.host_read | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.externalDatabase.host_write }}
  LAKEKEEPER__PG_HOST_W: {{ .Values.externalDatabase.host_write | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.externalDatabase.port }}
  LAKEKEEPER__PG_PORT: {{ .Values.externalDatabase.port | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.externalDatabase.database }}
  LAKEKEEPER__PG_DATABASE: {{ .Values.externalDatabase.database | toString | b64enc | quote }}
  {{- end }}
  {{- if not .Values.externalDatabase.userSecret }}
  LAKEKEEPER__PG_USER: {{ .Values.externalDatabase.user | toString | b64enc | quote }}
  {{- end }}
  {{- if not .Values.externalDatabase.passwordSecret }}
  LAKEKEEPER__PG_PASSWORD: {{ .Values.externalDatabase.password | toString | b64enc | quote }}
  {{- end }}
  {{- end }}

  # Lakekeeper License Configs
  {{- if and .Values.lakekeeper.licenseKey (not .Values.lakekeeper.useLicenseSecret) }}
  LAKEKEEPER__LICENSE__KEY: {{ .Values.lakekeeper.licenseKey | toString | b64enc | quote }}
  {{- end }}

  # OPENID Auth Configs
  {{- if .Values.auth.oauth2.providerUri }}
  LAKEKEEPER__OPENID_PROVIDER_URI: {{ .Values.auth.oauth2.providerUri | toString | b64enc | quote }}
  {{- if .Values.auth.oauth2.audience }}
  LAKEKEEPER__OPENID_AUDIENCE: {{ .Values.auth.oauth2.audience | toString | b64enc | quote }}
  {{- end }}
  # .Values.auth.oauth2.additionalIssuers is a list.
  # If it is not empty, join the list with a comma and set the value to LAKEKEEPER__OPENID_ADDITIONAL_ISSUERS
  {{- if .Values.auth.oauth2.additionalIssuers }}
  LAKEKEEPER__OPENID_ADDITIONAL_ISSUERS: {{ .Values.auth.oauth2.additionalIssuers | join "," | b64enc | quote }}
  {{- end }}
  {{- end }}

  # UI Auth configs
  {{- if .Values.auth.oauth2.ui.clientID }}
  LAKEKEEPER__UI__OPENID_CLIENT_ID: {{ .Values.auth.oauth2.ui.clientID | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.auth.oauth2.ui.scopes }}
  LAKEKEEPER__UI__OPENID_SCOPE: {{ .Values.auth.oauth2.ui.scopes | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.auth.oauth2.ui.resource }}
  LAKEKEEPER__UI__OPENID_RESOURCE: {{ .Values.auth.oauth2.ui.resource | toString | b64enc | quote }}
  {{- end }}

  # Kubernetes Auth Configs
  {{- if .Values.auth.k8s.enabled }}
  LAKEKEEPER__ENABLE_KUBERNETES_AUTHENTICATION: {{ "true" | b64enc | quote }}
  {{- if .Values.auth.k8s.audience }}
  LAKEKEEPER__KUBERNETES_AUTHENTICATION_AUDIENCE: {{ .Values.auth.k8s.audience | toString | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if .Values.auth.k8s.legacyEnabled }}
  LAKEKEEPER__KUBERNETES_AUTHENTICATION_ACCEPT_LEGACY_SERVICEACCOUNT: {{ "true" | b64enc | quote }}
  {{- end }}  

  # Secret store configs
  {{- if eq "postgres" (lower .Values.secretBackend.type) }}
  LAKEKEEPER__SECRET_BACKEND: {{ "Postgres" | b64enc | quote }}
  # LAKEKEEPER__PG_ENCRYPTION_KEY is mounted as secret
  {{- end }}
  {{- if eq "kv2" (lower .Values.secretBackend.type) }}
  LAKEKEEPER__KV2__URL: {{ .Values.secretBackend.kv2.url | toString | b64enc | quote }}
  {{- if .Values.secretBackend.kv2.user }}
  LAKEKEEPER__KV2__USER: {{ .Values.secretBackend.kv2.user | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.secretBackend.kv2.password }}
  LAKEKEEPER__KV2__PASSWORD: {{ .Values.secretBackend.kv2.password | toString | b64enc | quote }}
  {{- end }}
  LAKEKEEPER__KV2__SECRET_MOUNT: {{ .Values.secretBackend.kv2.secret_mount | toString | b64enc | quote }}
  {{- end }}

  # Authorization configs
  LAKEKEEPER__AUTHZ_BACKEND: {{ .Values.authz.backend | toString | b64enc | quote }}
  {{- if eq "openfga" (lower .Values.authz.backend) }}

  {{- if .Values.authz.openfga.endpoint }}
  LAKEKEEPER__OPENFGA__ENDPOINT: {{ .Values.authz.openfga.endpoint | toString | b64enc | quote }}
  {{- else if .Values.internalOpenFGA }}
  LAKEKEEPER__OPENFGA__ENDPOINT: {{ printf "http://%s.%s.svc.%s:%d" (  include "iceberg-catalog.openfga.fullname" . ) (.Release.Namespace) (.Values.clusterDomain) (int (split ":" .Values.openfga.grpc.addr)._1) | b64enc | quote }}
  {{- end }}

  {{- if .Values.authz.openfga.store }}
  LAKEKEEPER__OPENFGA__STORE_NAME: {{ .Values.authz.openfga.store | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.authz.openfga.apiKey }}
  LAKEKEEPER__OPENFGA__API_KEY: {{ .Values.authz.openfga.apiKey | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.authz.openfga.clientId }}
  LAKEKEEPER__OPENFGA__CLIENT_ID: {{ .Values.authz.openfga.clientId | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.authz.openfga.clientSecret }}
  LAKEKEEPER__OPENFGA__CLIENT_SECRET: {{ .Values.authz.openfga.clientSecret | toString | b64enc | quote }}
  {{- end }}
  {{- if .Values.authz.openfga.tokenEndpoint }}
  LAKEKEEPER__OPENFGA__TOKEN_ENDPOINT: {{ .Values.authz.openfga.tokenEndpoint | toString | b64enc | quote }}
  {{- end }}
  {{- end }}

  # User Configs
  {{- range $k, $v := .Values.catalog.config }}
  {{ $k | quote }}: {{ $v | toString | b64enc | quote }}
  {{- end }}