{{- if and .Values.istio.enabled (or .Values.addons.authservice.enabled (and .Values.monitoring.enabled .Values.monitoring.sso.enabled) (and .Values.jaeger.enabled .Values.jaeger.sso.enabled) (and .Values.tempo.enabled .Values.tempo.sso.enabled) (and .Values.addons.thanos.enabled .Values.addons.thanos.sso.enabled) (and .Values.addons.holocron.enabled .Values.addons.holocron.sso.enabled)) }}
{{- include "values-secret" (dict "root" $ "package" .Values.addons.authservice "name" "authservice" "defaults" (include "bigbang.defaults.authservice" .)) }}
{{- end }}

{{- define "bigbang.defaults.authservice" -}}
# hostname is deprecated and replaced with domain. But if hostname exists then use it.
{{- $domainName := default .Values.domain .Values.hostname }}
{{- $authServiceHardened := or (dig "istio" "hardened" "enabled" false .Values.monitoring.values) (dig "istio" "hardened" "enabled" false .Values.addons.authservice.values) (dig "hardened" "enabled" false .Values.istio.values) (dig "istio" "hardened" "enabled" false .Values.grafana.values) }}

istio:
  enabled: {{ .Values.istio.enabled }}
  hardened:
    {{- if $authServiceHardened }}
    enabled: true
    {{- else}}
    enabled: false
    {{- end }}
  clusterWideHardenedEnabled: {{ or .Values.istio.values.hardened.enabled .Values.addons.authservice.values.istio.clusterWideEnabled }}

image: 
  pullPolicy: {{ .Values.imagePullPolicy }}
  
imagePullSecrets:
  - name: private-registry

podAnnotations:
  {{ include "istioAnnotation" . }}

openshift: {{ .Values.openshift }}

monitoring:
  enabled: {{ .Values.monitoring.enabled }}

networkPolicies:
  enabled: {{ .Values.networkPolicies.enabled }}
  ingressLabels:
    {{- $gateway := default "public" .Values.addons.haproxy.ingress.gateway }}
    {{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}
    {{- toYaml (dig "values" "gateways" $gateway "selector" $default .Values.istio) | nindent 4 }}

{{- if or (dig "redis" "enabled" false .Values.addons.authservice.values) (dig "global" "redis_server_uri" "" .Values.addons.authservice.values) }}
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 3
{{- end }}

{{- if and (dig "redis" "enabled" false .Values.addons.authservice.values) .Values.monitoring.enabled }}
redis-bb:
  metrics:
    enabled: true 
    image:
      pullSecrets:
        - private-registry
    serviceMonitor:
      enabled: true
      namespace: authservice
      selector: 
        app.kubernetes.io/name: redis-bb
        app.kubernetes.io/instance: authservice-authservice
      # conditional passes only if all conditionals are true:
      # - istio: enabled
      # - mTLS: SCRICT
      # - istio injection: enabled (for logging ns)
      {{- if and .Values.istio.enabled (eq (dig "istio" "mtls" "mode" "STRICT" .Values.addons.authservice.values) "STRICT") }}
      scheme: https
      tlsConfig:
        caFile: /etc/prom-certs/root-cert.pem
        certFile: /etc/prom-certs/cert-chain.pem
        keyFile: /etc/prom-certs/key.pem
        insecureSkipVerify: true  
      {{- end }}
    prometheusRule:
      enabled: true 
      namespace: monitoring
{{- end }}

{{- $legacy := and .Values.sso.oidc.realm .Values.sso.oidc.host -}}
{{- if not $legacy }}
issuer_uri: {{ include "sso.url" . }}
{{- end }}

global:
  oidc:
    host: {{ default (include "sso.host" .) .Values.sso.oidc.host }}
    realm: {{ default (include "sso.realm" .) .Values.sso.oidc.realm }}

  {{- if or .Values.sso.jwks_uri (dig "oidc" "jwksUri" false .Values.sso) }}
  jwks_uri: {{ include "sso.oidc.jwksuri" . | quote }}
  {{- else if or .Values.sso.jwks (dig "oidc" "jwks" false .Values.sso) }}
  jwks: {{ default (dig "oidc" "jwks" "" .Values.sso) .Values.sso.jwks | quote }}
  {{- end }}

  {{- if or .Values.sso.client_id (dig "sso" "client_id" false .Values.addons.authservice) }}
  client_id: {{ default (dig "sso" "client_id" "" .Values.addons.authservice) .Values.sso.client_id }}
  {{- end }}

  {{- if or .Values.sso.client_secret (dig "sso" "client_secret" false .Values.addons.authservice) }}
  client_secret: {{ default (dig "sso" "client_secret" "" .Values.addons.authservice) .Values.sso.client_secret }}
  {{- end }}

  {{- if (or .Values.sso.certificate_authority (dig "certificateAuthority" "cert" false .Values.sso)) }}
  certificate_authority: {{ (default (dig "certificateAuthority" "cert" "" .Values.sso) .Values.sso.certificate_authority) | quote }}
  {{- end }}

  {{- if not $legacy }}
  authorization_uri: {{ include "sso.oidc.auth" . }}
  token_uri: {{ include "sso.oidc.token" . }}
  logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
  {{- end }}

  {{- $authserviceValues := .Values.addons.authservice.values | default dict }}
  {{- $redisValues := $authserviceValues.redis | default dict }}
  {{- if hasKey $redisValues "enabled" }}
  {{- if $redisValues.enabled }}
  redis_server_uri: "tcp://authservice-authservice-redis-bb-master:6379"
  {{- end }}
  {{- end }}

chains:
  {{- if .Values.addons.authservice.chains }}
  {{ .Values.addons.authservice.chains | toYaml | nindent 2 }}
  {{- end }}

  {{- if and .Values.jaeger.enabled .Values.jaeger.sso.enabled }}
  jaeger:
    match:
      header: ":authority"
    {{- $jaegerHosts := (dig "istio" "jaeger" "hosts" dict .Values.jaeger.values) }}
    {{- if $jaegerHosts }}
      prefix: {{ tpl ($jaegerHosts | first) $ }}
    callback_uri: https://{{ tpl ($jaegerHosts | first) $ }}/login
    {{- else }}
      prefix: {{ printf "tracing.%s" $domainName }}
    callback_uri: https://tracing.{{ $domainName }}/login
    {{- end }}
    client_id: "{{ .Values.jaeger.sso.client_id }}"
    client_secret: "{{ .Values.jaeger.sso.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}
  {{- end }}

  {{- if and .Values.addons.holocron.enabled .Values.addons.holocron.sso.enabled }}
  holocron:
    match:
      header: ":authority"
    {{- $holocronHosts := (dig "istio" "holocron" "hosts" dict .Values.addons.holocron.values) }}
    {{- if $holocronHosts }}
      prefix: {{ tpl ($holocronHosts | first) $ }}
    callback_uri: https://{{ tpl ($holocronHosts | first) $ }}/login
    {{- else }}
      prefix: {{ printf "holocron.%s" $domainName }}
    callback_uri: https://holocron.{{ $domainName }}/login
    {{- end }}
    client_id: "{{ .Values.addons.holocron.sso.client_id }}"
    client_secret: "{{ .Values.addons.holocron.sso.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}
  {{- end }}

  {{- if and .Values.addons.thanos.enabled .Values.addons.thanos.sso.enabled }}
  thanos:
    match:
      header: ":authority"
    {{- $thanosHosts := (dig "istio" "thanos" "hosts" dict .Values.addons.thanos.values) }}
    {{- if $thanosHosts }}
      prefix: {{ tpl ($thanosHosts | first) $ }}
    callback_uri: https://{{ tpl ($thanosHosts | first) $ }}/login/generic_oauth
    {{- else }}
      prefix: {{ printf "thanos.%s" $domainName }}
    callback_uri: https://thanos.{{ $domainName }}/login/generic_oauth
    {{- end }}
    client_id: "{{ .Values.addons.thanos.sso.client_id }}"
    client_secret: "{{ .Values.addons.thanos.sso.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}
  {{- end }}

  {{- if and .Values.tempo.enabled .Values.tempo.sso.enabled }}
  tempo:
    match:
      header: ":authority"
    {{- $tempoHosts := (dig "istio" "tempoQuery" "hosts" dict .Values.tempo.values) }}
    {{- if $tempoHosts }}
      prefix: {{ tpl ($tempoHosts | first) $ }}
    callback_uri: https://{{ tpl ($tempoHosts | first) $ }}/login
    {{- else if .Values.jaeger.enabled }}
      prefix: {{ printf "tempo.%s" $domainName }}
    callback_uri: https://tempo.{{ $domainName }}/login
    {{- else }}
      prefix: {{ printf "tracing.%s" $domainName }}
    callback_uri: https://tracing.{{ $domainName }}/login
    {{- end }}
    client_id: "{{ .Values.tempo.sso.client_id }}"
    client_secret: "{{ .Values.tempo.sso.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}
  {{- end }}

  {{- if and .Values.monitoring.enabled .Values.monitoring.sso.enabled }}
  prometheus:
    match:
      header: ":authority"
    {{- $prometheusHosts := (dig "istio" "prometheus" "hosts" dict .Values.monitoring.values) }}
    {{- if $prometheusHosts }}
      prefix: {{ tpl ($prometheusHosts | first) $ }}
    callback_uri: https://{{ tpl ($prometheusHosts | first) $ }}/login/generic_oauth
    {{- else }}
      prefix: {{ printf "prometheus.%s" $domainName }}
    callback_uri: https://prometheus.{{ $domainName }}/login/generic_oauth
    {{- end }}
    client_id: {{ .Values.monitoring.sso.prometheus.client_id }}
    client_secret: "{{ .Values.monitoring.sso.prometheus.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}

  alertmanager:
    match:
      header: ":authority"
    {{- $alertmanagerHosts := (dig "istio" "alertmanager" "hosts" dict .Values.monitoring.values) }}
    {{- if $alertmanagerHosts }}
      prefix: {{ tpl ($alertmanagerHosts | first) $ }}
    callback_uri: https://{{ tpl ($alertmanagerHosts | first) $ }}/login/generic_oauth
    {{- else }}
      prefix: {{ printf "alertmanager.%s" $domainName }}
    callback_uri: https://alertmanager.{{ $domainName }}/login/generic_oauth
    {{- end }}
    client_id: {{ .Values.monitoring.sso.alertmanager.client_id }}
    client_secret: "{{ .Values.monitoring.sso.alertmanager.client_secret }}"
    {{- if not $legacy }}
    authorization_uri: {{ include "sso.oidc.auth" . }}
    token_uri: {{ include "sso.oidc.token" . }}
    logout_redirect_uri: {{ include "sso.oidc.endsession" . }}
    {{- end }}
  {{- end }}
{{- end -}}
