apiVersion: batch/v1
kind: Job
metadata:
  name: knoe-kdc-init
  namespace: knoe-system
  labels:
    app: knoe-kdc
spec:
  ttlSecondsAfterFinished: 300
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: kdc-init
          image: debian:bookworm-slim
          command:
            - /bin/bash
            - -c
            - |
              set -euo pipefail
              export DEBIAN_FRONTEND=noninteractive
              if ! command -v krb5-user >/dev/null 2>&1 && ! command -v kadmin >/dev/null 2>&1; then
                apt-get update -qq
                apt-get install -y --no-install-recommends krb5-user ca-certificates
                rm -rf /var/lib/apt/lists/*
              fi
              # Wait for KDC to be reachable
              echo "Waiting for KDC at knoe-kdc:88..."
              for i in $(seq 1 30); do
                if timeout 2 bash -c "echo > /dev/tcp/knoe-kdc/88" 2>/dev/null; then
                  echo "KDC is reachable."
                  break
                fi
                echo "  attempt $i/30 — not ready yet, sleeping 5s..."
                sleep 5
              done
              # Verify admin principal exists via kadmin
              echo "Verifying admin/admin@KNOE.LOCAL principal..."
              kadmin -p admin/admin@KNOE.LOCAL \
                     -w "${KNOE_KDC_ADMIN_PASSWORD}" \
                     -s knoe-kdc \
                     -q "get_principal admin/admin@KNOE.LOCAL" \
                && echo "Principal admin/admin@KNOE.LOCAL confirmed." \
                || { echo "WARNING: could not verify principal (KDC may still be initializing)"; exit 0; }
              echo "knoe-kdc-init: DONE"
          env:
            - name: KRB5_CONFIG
              value: /opt/knoe-kdc/krb5.conf
            - name: KNOE_KDC_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: knoe-kdc-secrets
                  key: admin_password
          volumeMounts:
            - name: kdc-config
              mountPath: /opt/knoe-kdc
      volumes:
        - name: kdc-config
          configMap:
            name: knoe-kdc-config
            defaultMode: 0755