# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0

file:
  {{ .Vars.server.persistence.mountPath }}:
    exists: true
    filetype: directory
    mode: '2775'
    owner: root
addr:
  tcp://vault-server-active:{{ .Vars.server.service.active.ports.internal }}:
    reachable: true
    timeout: 500
  tcp://vault-server:{{ .Vars.server.service.general.ports.internal }}:
    reachable: true
    timeout: 500
  tcp://127.0.0.1:{{ .Vars.server.containerPorts.internal }}:
    reachable: true
    timeout: 500
http:
  http://vault-server-active:{{ .Vars.server.service.active.ports.http }}:
    status: 200
  http://vault-server:{{ .Vars.server.service.general.ports.http }}:
    status: 200
  http://127.0.0.1:{{ .Vars.server.containerPorts.http }}:
    status: 200
command:
  {{- $uid := .Vars.server.containerSecurityContext.runAsUser }}
  {{- $gid := .Vars.server.podSecurityContext.fsGroup }}
  check-user-info:
    # The UID and GID should always be either the one specified as vars (always a bigger number that the def<ault)
    # or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value.
    exec: if [ $(id -u) -lt {{ $uid }} ] || [ $(id -G | awk '{print $2}') -lt {{ $gid }} ]; then exit 1; fi
    exit-status: 0
  {{- if .Vars.server.containerSecurityContext.enabled }}
  check-no-capabilities:
    exec: cat /proc/1/status
    exit-status: 0
    stdout:
    - "CapInh:	0000000000000000"
    - "CapPrm:	0000000000000000"
    - "CapEff:	0000000000000000"
    - "CapBnd:	0000000000000000"
    - "CapAmb:	0000000000000000"
  {{- end }}
  {{ if .Vars.server.serviceAccount.automountServiceAccountToken }}
  check-sa:
    exec: cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -d '.' -f 2 | xargs -I '{}' echo '{}====' | fold -w 4 | sed '$ d' | tr -d '\n' | base64 -d
    exit-status: 0
    stdout:
    - /serviceaccount.*name.*vault-server/
  {{ end }}
  create-and-retrieve-secret:
  {{- $path_name := printf "vib%s" (randAlpha 5) }}
  {{- $secret_name := printf "password%s" (randAlpha 5 | toLower) }}
  {{- $password := randAlpha 5 | toLower }}
    exec: . {{ .Vars.server.persistence.mountPath }}/vault-token;  vault secrets enable -path={{ $path_name }} kv-v2 && vault kv put {{ $path_name }}/{{ $secret_name }} password="{{ $password }}" && vault kv get {{ $path_name }}/{{ $secret_name }}
    exit-status: 0
    stdout:
    - /password.*{{ $password }}/
