# Argo WorkflowTemplate — build + deploy the fxhnt cockpit, fully in-cluster.
#
# Mirrors foxhunt's proven `build-ci-image` (Kaniko) + `compile-and-deploy` (kubectl) patterns, reusing the
# same cluster primitives: the `argo-workflow` ServiceAccount, the `argo-git-ssh-key` deploy key (clone over
# the in-cluster gitlab-shell), and the `gitlab-registry` dockerconfig (push to the internal registry). The
# build runs in-cluster so it reaches the registry + token endpoint natively — no laptop, no private-CA trust,
# nothing public.
#
# Submit:  argo submit -n foxhunt --from=wftmpl/fxhnt-cockpit -p commit-sha=<sha> --watch
# (or use scripts/argo-deploy-cockpit.sh)
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: fxhnt-cockpit
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-cockpit, app.kubernetes.io/part-of: foxhunt }
spec:
  serviceAccountName: argo-workflow
  entrypoint: pipeline
  archiveLogs: true           # archive build/deploy logs to MinIO (argo-logs bucket). Reachable now that the
                              # pods carry app.kubernetes.io/part-of: argo-workflows (MinIO ingress netpol allow).
  activeDeadlineSeconds: 1800
  ttlStrategy: { secondsAfterCompletion: 3600 }
  podGC: { strategy: OnPodCompletion }
  arguments:
    parameters:
      - { name: commit-sha, value: HEAD }
  templates:
    - name: pipeline
      dag:
        tasks:
          - { name: build, template: kaniko-build }
          - { name: deploy, template: kubectl-deploy, depends: build }

    # --- build: Kaniko builds infra/docker/fxhnt.Dockerfile -> internal registry ---
    - name: kaniko-build
      metadata:
        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allows part-of in {foxhunt,foxhunt-ci,argo-workflows} → log archival works. NOT 'foxhunt' (that adds argo-base-egress which blocks registry:5000/git:2222).
      nodeSelector: { k8s.scaleway.com/pool-name: ci-compile-cpu, topology.kubernetes.io/zone: fr-par-2 }
      tolerations: [{ effect: NoSchedule, key: node.cilium.io/agent-not-ready, operator: Exists }]
      initContainers:
        - name: git-clone
          image: alpine/git:latest
          command: [/bin/sh, -c]
          args:
            - |
              set -ex
              mkdir -p /root/.ssh
              cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
              chmod 600 /root/.ssh/id_ed25519
              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
              git clone --no-checkout --filter=blob:none \
                "ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/fxhnt.git" /workspace/src
              cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
              echo "checked out $(git rev-parse --short HEAD)"
          volumeMounts:
            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
            - { name: workspace, mountPath: /workspace }
      container:
        image: gcr.io/kaniko-project/executor:debug
        command: [/busybox/sh, -c]
        args:
          - |
            /kaniko/executor \
              --context=/workspace/src \
              --dockerfile=/workspace/src/infra/docker/fxhnt.Dockerfile \
              --destination=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest \
              --insecure-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
              --skip-tls-verify-registry=gitlab-registry.foxhunt.svc.cluster.local:5000 \
              --cache=true \
              --cache-repo=gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/cache \
              --snapshot-mode=redo
        env:
          - { name: DOCKER_CONFIG, value: /kaniko/.docker }
        resources: { requests: { cpu: "2", memory: 4Gi }, limits: { cpu: "6", memory: 12Gi } }
        volumeMounts:
          - { name: registry-auth, mountPath: /kaniko/.docker, readOnly: true }
          - { name: workspace, mountPath: /workspace }
      volumes:
        - { name: workspace, emptyDir: {} }
        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
        - name: registry-auth
          secret:
            secretName: gitlab-registry
            items: [{ key: .dockerconfigjson, path: config.json }]

    # --- deploy: apply manifests from the repo + roll the dashboard to the fresh image ---
    - name: kubectl-deploy
      metadata:
        labels: { app.kubernetes.io/part-of: argo-workflows }   # MinIO ingress allow → log archival works (see kaniko-build note)
      nodeSelector: { k8s.scaleway.com/pool-name: platform, topology.kubernetes.io/zone: fr-par-2 }
      serviceAccountName: argo-workflow
      initContainers:
        - name: git-clone
          image: alpine/git:latest
          command: [/bin/sh, -c]
          args:
            - |
              set -ex
              mkdir -p /root/.ssh
              cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
              chmod 600 /root/.ssh/id_ed25519
              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
              git clone --no-checkout --filter=blob:none \
                "ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/fxhnt.git" /workspace/src
              cd /workspace/src && git checkout "{{workflow.parameters.commit-sha}}"
          volumeMounts:
            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
            - { name: workspace, mountPath: /workspace }
      container:
        image: alpine/k8s:1.31.0   # Alpine-based (has /bin/sh + kubectl). NOT registry.k8s.io/kubectl — that's distroless (no shell) and the deploy runs a shell script. bitnami/kubectl was removed from Docker Hub (2025).
        command: [/bin/sh, -c]
        args:
          - |
            set -e
            cd /workspace/src
            kubectl apply -f infra/k8s/services/fxhnt-dashboard.yaml
            kubectl apply -f infra/k8s/jobs/fxhnt-forward-cronjob.yaml
            kubectl apply -f infra/k8s/orchestration/dagster.yaml
            kubectl apply -f infra/k8s/network-policies/fxhnt-cockpit.yaml
            kubectl -n foxhunt rollout restart deploy/fxhnt-dashboard
            kubectl -n foxhunt rollout restart deploy/dagster
            kubectl -n foxhunt rollout status deploy/fxhnt-dashboard --timeout=180s
            kubectl -n foxhunt rollout status deploy/dagster --timeout=300s
        volumeMounts:
          - { name: workspace, mountPath: /workspace }
      volumes:
        - { name: workspace, emptyDir: {} }
        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
