# Fixtures for the bulwark install-test: the two Secrets the 1Password operator
# would otherwise materialize from the OnePasswordItems the chart renders
# (release name: ci, stub CRD in ci/common/), plus a name for the JMAP endpoint
# to resolve to.
#
# NO DATABASE, NO CACHE, NO BROKER AND NO MAIL SERVER - and that is a property of
# the chart rather than a shortcut taken here. Bulwark is a client: it holds no
# mail and contacts the JMAP server per request, not at boot, so it starts and
# becomes Ready with nothing behind that URL. The flip side is the limitation the
# chart documents at bulwark.readinessProbe, and this file is the clearest
# illustration of it: everything needed to make this chart green is in these few
# objects, and none of it is a mail server.
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-bulwark-app-secret
stringData:
  # The field NAMES are what matter here, not the values: the operator
  # materializes one Secret key per item field, and the chart consumes these two
  # in DIFFERENT ways - session-secret as a projected FILE, admin-password
  # through a secretKeyRef.
  #
  # Only the second of those is actually asserted by the run. The projected
  # volume is `optional: true` by design (so a first install does not hang
  # waiting for the 1Password operator), so a misspelled session-secret yields a
  # missing file and a pod that starts fine. A misspelled admin-password leaves
  # the container in CreateContainerConfigError and fails the run.
  #
  # A real base64 32-byte value rather than a placeholder word: Bulwark derives
  # encryption keys from it, and a value of the wrong shape would be the kind of
  # thing that works in CI and not in production.
  session-secret: Y2ktb25seS1zZXNzaW9uLXNlY3JldC1ub3QtYS1yZWFsLW9uZQ==
  # Visibly throwaway. It is hashed with scrypt into admin.json on the first
  # start and the cluster is deleted with the job; the only thing it protects is
  # a dashboard that exists for a few minutes.
  admin-password: ci-bulwark-admin-password
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-bulwark-oauth-secret
stringData:
  # The OIDC client secret. Nothing in CI performs a token exchange - no identity
  # provider runs here - so this exists to exercise the SECOND source of the
  # chart's projected volume and the OAUTH_CLIENT_SECRET_FILE path, not the OAuth
  # flow.
  oauth-client-secret: ci-bulwark-oauth-client-secret
---
# The JMAP endpoint's name. A Service with NO SELECTOR and therefore no
# endpoints: the in-cluster DNS name resolves, and a connection to it is refused.
#
# DELIBERATELY NOT A DEPLOYMENT. ci/run-install-test.sh waits for every fixture
# Deployment and StatefulSet to roll out BEFORE it installs the chart, so a stub
# web server here would be one more workload able to fail a run that is not about
# it - and it would buy nothing, because a refused connection and a served 404
# are indistinguishable to a chart that never contacts this address at boot.
#
# It exists at all so the URL in test-values.yaml is a real name rather than an
# invented hostname, which keeps the fixture honest about what the chart does
# with it.
apiVersion: v1
kind: Service
metadata:
  name: jmap-stub
spec:
  ports:
    - port: 8080
      targetPort: 8080