write_lane_profile() {
  local lane="$1"
  local coordination="$2"
  local oidc="$3"
  local target="$4"
  local profile="nuthatch-fixture-lane-$lane"
  local profile_file="$RUNTIME/$profile.env"
  local database=
  local coordination_database=
  local oidc_issuer=
  local oidc_client_id=
  local oidc_client_secret=
  local oidc_additional_audiences=
  local oidc_redirect_uri=
  local oidc_user_a=
  local oidc_user_b=
  local target_url=
  local target_bucket=
  local target_region=
  local target_access_key=
  local target_secret_key=
  if fixture_has_family durable; then
    database="$(reset_lane_durable_store "$lane")" || return
  fi
  if fixture_has_family coordination; then
    coordination_database="$(reset_lane_coordination_store "$coordination" "$lane")" || return
  fi
  if fixture_has_family oidc; then
    oidc_redirect_uri="https://nuthatch-$lane:8080/oidc/callback"
    case "$oidc" in
      keycloak) oidc_issuer=http://keycloak.nuthatch.test:8080/realms/master ;;
      zitadel) oidc_issuer=http://zitadel.nuthatch.test:8080 ;;
      *) return 1 ;;
    esac
    case "$oidc" in
      keycloak)
        provision_lane_keycloak_registration \
          "$lane" \
          "$oidc_redirect_uri" \
          oidc_client_id \
          oidc_client_secret \
          oidc_additional_audiences \
          oidc_user_a \
          oidc_user_b || return
        ;;
      zitadel)
        provision_lane_zitadel_registration \
          "$lane" \
          "$oidc_redirect_uri" \
          oidc_client_id \
          oidc_client_secret \
          oidc_additional_audiences \
          oidc_user_a \
          oidc_user_b || return
        ;;
      *) return 1 ;;
    esac
    create_oidc_automation_secret "$lane" "$oidc" || return
  fi
  if fixture_has_family target; then
    target_bucket="nuthatch-lane-$lane"
    target_url="$(target_endpoint "$target")" || return
    ensure_target_scope_canary "$target" || return
    provision_lane_target_principal \
      "$target" \
      "$lane" \
      "$target_bucket" \
      target_access_key \
      target_secret_key || return
    case "$target" in
      garage) target_region=garage ;;
      versitygw) target_region=us-east-1 ;;
      *) return 1 ;;
    esac
  fi
  {
    printf 'NUTHATCH_FIXTURE_PROFILE=%s\n' "$profile"
    printf 'NUTHATCH_FIXTURE_LANE=%s\n' "$lane"
    printf 'NUTHATCH_COORDINATION_PROVIDER=%s\n' "$coordination"
    printf 'NUTHATCH_OIDC_PROVIDER=%s\n' "$oidc"
    printf 'NUTHATCH_TARGET_PROVIDER=%s\n' "$target"
    printf 'NUTHATCH_PG_CONN=host=postgres port=5432 user=nuthatch password=synthetic-postgres dbname=%s\n' "$database"
    printf 'NUTHATCH_REDIS_URL=redis://%s:6379/%s\n' "$coordination" "$coordination_database"
    printf 'NUTHATCH_OIDC_ISSUER=%s\n' "$oidc_issuer"
    printf 'NUTHATCH_OIDC_CLIENT_ID=%s\n' "$oidc_client_id"
    printf 'NUTHATCH_OIDC_ADDITIONAL_AUDIENCES=%s\n' "$oidc_additional_audiences"
    printf 'NUTHATCH_OIDC_REDIRECT_URI=%s\n' "$oidc_redirect_uri"
    printf 'NUTHATCH_OIDC_USER_A=%s\n' "$oidc_user_a"
    printf 'NUTHATCH_OIDC_USER_B=%s\n' "$oidc_user_b"
    printf 'NUTHATCH_OIDC_USER_PASSWORD=Synthetic-OIDC-1!\n'
    printf 'NUTHATCH_S3_ENDPOINT=%s\n' "$target_url"
    printf 'NUTHATCH_S3_BUCKET=%s\n' "$target_bucket"
    printf 'NUTHATCH_S3_REGION=%s\n' "$target_region"
    printf 'NUTHATCH_S3_ACCESS_KEY=%s\n' "$target_access_key"
    printf 'NUTHATCH_S3_SECRET_KEY=%s\n' "$target_secret_key"
    printf 'NUTHATCH_S3_PATH_STYLE=true\n'
  } > "$profile_file" || return
  if fixture_has_family oidc; then
    printf '%s' "$oidc_client_secret" > "$profile_file.oidc-secret" || return
    chmod 0600 "$profile_file.oidc-secret" || return
  fi
  kube create configmap "$profile" \
    --namespace "$FIXTURE_NAMESPACE" \
    --from-env-file="$profile_file" \
    --dry-run=client \
    --output yaml |
    kube apply --filename - >/dev/null || return
  kube create configmap "$profile-file" \
    --namespace "$FIXTURE_NAMESPACE" \
    --from-file="profile.env=$profile_file" \
    --dry-run=client \
    --output yaml |
    kube apply --filename - >/dev/null || return
  printf '%s\n' "$profile"
}

render_lane_job() {
  local job="$1"
  local manifest="$2"
  local image="$3"
  local profile="$4"
  source "$RUNTIME/fixture.env" || return
  sed \
    -e "s|@@JOB_NAME@@|$job|g" \
    -e "s|@@PROFILE_NAME@@|$profile|g" \
    -e "s|@@TEST_IMAGE@@|$image|g" \
    "$manifest" > "$RUNTIME/$job.yaml"
}

run_job_manifest() {
  local job="$1"
  local manifest="$2"
  kube --namespace "$FIXTURE_NAMESPACE" delete "job/$job" --ignore-not-found >/dev/null || return
  kube apply --filename "$manifest" >/dev/null || return
  wait_for_job "$job"
}