apiVersion: batch/v1
kind: Job
metadata:
  name: installplan-approver
  namespace: sso
spec:
  template:
    spec:
      containers:
        - image: registry.redhat.io/openshift4/ose-cli:v4.4
          env:
            - name: APPROVAL_NAMESPACES
              value: "sso"
            - name: GENERATE_OPENID_CERT
              value: 'false'
          command:
            - /bin/bash
            - -c
            - |
              export HOME=/tmp/approver

              echo "Approving RH-SSO operator install.  Waiting a few seconds to make sure the InstallPlan gets created first."
              sleep 20
              for subscription in `oc get sub -n sso -o name`
              do
                echo "Subs: ${subscription}"
                while [[ "$(oc get $subscription -n sso -o jsonpath='{ .status.currentCSV }')" == "" ]]
                do
                    sleep 2;
                done
                desiredcsv=$(oc get $subscription -n sso -o jsonpath='{ .status.currentCSV }')
                echo "Desired csv: $desiredcsv"

                until [ "$(oc get installplan -n sso -o jsonpath="{.items[?(@.spec.clusterServiceVersionNames[*] == \"$desiredcsv\")].metadata.name}")" != "" ]; do sleep 2; done

                installplans=$(oc get installplan -n sso -o jsonpath="{.items[?(@.spec.clusterServiceVersionNames[*] == \"$desiredcsv\")].metadata.name}")

                for installplan in ${installplans[@]}
                do
                  echo "installplan: ${installplan}"
                  if [ "`oc get installplan $installplan -n sso -o jsonpath="{.spec.approved}"`" == "false" ]; then

                    echo "Approving Subscription $subscription with install plan $installplan"

                    oc patch -n sso installplan $installplan --type=json -p='[{"op":"replace","path": "/spec/approved", "value": true}]'

                  else
                    echo "Install Plan '$installplan' already approved"
                  fi
                done
              done

              if [ "$GENERATE_OPENID_CERT" == true ] ; then

                  echo "GENERATE_OPENID_CERT set to 'true'.  Create a ConfigMap named openidcrt in the openshift-config project."

                  # Get name of certs secret.  It can be router-certs or router-certs-default.
                  CERT_SECRET=$(oc get secrets -n openshift-ingress | grep 'router-certs\|ingress-certs\|-ingress' | cut -d ' ' -f1)

                  tlscert=`oc get secrets/$CERT_SECRET -o jsonpath={.data.'tls\.crt'} -n openshift-ingress | base64 --decode`
                  oc create configmap openidcacrt --from-literal ca.crt="$tlscert" -n openshift-config

              else

                  echo "GENERATE_OPENID_CERT set to 'false'.  Will not create an openidcrt ConfigMap in the openshift-config namespace."

              fi

          imagePullPolicy: Always
          name: installplan-approver-and-cert-secret
      dnsPolicy: ClusterFirst
      restartPolicy: OnFailure
      serviceAccount: rhsso-operator-job
      serviceAccountName: rhsso-operator-job
      terminationGracePeriodSeconds: 30
