apiVersion: v1
kind: ConfigMap
metadata:
  name: probe-payload
  namespace: remora-testbed
data:
  payload: remora-dependency-testbed-published-image-transfer
---
apiVersion: batch/v1
kind: Job
metadata:
  name: state-probe
  namespace: remora-testbed
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      initContainers:
        - name: postgres
          image: @@POSTGRES_IMAGE@@
          imagePullPolicy: Never
          command: [psql]
          args:
            - -h
            - postgres
            - -U
            - remora
            - -d
            - remora
            - -v
            - ON_ERROR_STOP=1
            - -c
            - "CREATE TABLE dependency_probe (value text NOT NULL)"
            - -c
            - "INSERT INTO dependency_probe VALUES ('passed')"
            - -c
            - "SELECT value = 'passed' FROM dependency_probe"
          env:
            - {name: PGPASSWORD, value: synthetic-postgres}
        - name: redis
          image: @@REDIS_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["redis-cli -h redis SET dependency_probe passed && test \"$(redis-cli -h redis GET dependency_probe)\" = passed"]
        - name: dragonfly
          image: @@REDIS_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["redis-cli -h dragonfly SET dependency_probe passed && test \"$(redis-cli -h dragonfly GET dependency_probe)\" = passed"]
        - name: vault-write
          image: @@VAULT_IMAGE@@
          imagePullPolicy: Never
          command: [vault]
          args: [kv, put, secret/dependency_probe, value=passed]
          env:
            - {name: VAULT_ADDR, value: "http://vault:8200"}
            - {name: VAULT_TOKEN, value: synthetic-vault-token}
      containers:
        - name: vault-read
          image: @@VAULT_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["test \"$(vault kv get -field=value secret/dependency_probe)\" = passed && printf 'Vault write/read passed\\n'"]
          env:
            - {name: VAULT_ADDR, value: "http://vault:8200"}
            - {name: VAULT_TOKEN, value: synthetic-vault-token}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: oidc-probe
  namespace: remora-testbed
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      dnsPolicy: None
      dnsConfig:
        nameservers: [10.96.0.53]
      containers:
        - name: curl
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              probe() {
                url="$1"
                pattern="$2"
                attempt=0
                until curl --fail --silent --show-error "$url" | grep -q "$pattern"; do
                  attempt=$((attempt + 1))
                  test "$attempt" -lt 30
                  sleep 1
                done
              }
              probe http://keycloak.remora.test:8080/realms/master/.well-known/openid-configuration '"issuer"'
              probe http://keycloak.remora.test:8080/realms/master/protocol/openid-connect/certs '"keys"'
              probe http://zitadel.remora.test:8080/.well-known/openid-configuration '"issuer"'
              probe http://zitadel.remora.test:8080/oauth/v2/keys '"keys"'
              printf 'Keycloak and ZITADEL discovery passed through controlled DNS\n'
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: garage-probe
  namespace: remora-testbed
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      initContainers:
        - name: bucket
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://garage:3900 s3api head-bucket --bucket remora-fixture; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
            - {name: AWS_DEFAULT_REGION, value: garage}
        - name: upload
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://garage:3900 s3api put-object --bucket remora-fixture --key smoke/payload --body /fixture/payload; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
            - {name: AWS_DEFAULT_REGION, value: garage}
          volumeMounts:
            - {name: fixture, mountPath: /fixture}
        - name: download
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://garage:3900 s3api get-object --bucket remora-fixture --key smoke/payload /work/result; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
            - {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
            - {name: AWS_DEFAULT_REGION, value: garage}
          volumeMounts:
            - {name: work, mountPath: /work}
      containers:
        - name: compare
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["cmp /fixture/payload /work/result && printf 'Garage transfer passed\\n'"]
          volumeMounts:
            - {name: fixture, mountPath: /fixture}
            - {name: work, mountPath: /work}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
      volumes:
        - name: fixture
          configMap: {name: probe-payload}
        - name: work
          emptyDir: {}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: versitygw-probe
  namespace: remora-testbed
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      initContainers:
        - name: bucket
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://versitygw:10000 s3api create-bucket --bucket remora-fixture || aws --endpoint-url http://versitygw:10000 s3api head-bucket --bucket remora-fixture; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
            - {name: AWS_DEFAULT_REGION, value: us-east-1}
        - name: upload
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://versitygw:10000 s3api put-object --bucket remora-fixture --key smoke/payload --body /fixture/payload; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
            - {name: AWS_DEFAULT_REGION, value: us-east-1}
          volumeMounts:
            - {name: fixture, mountPath: /fixture}
        - name: download
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              attempt=0
              until aws --endpoint-url http://versitygw:10000 s3api get-object --bucket remora-fixture --key smoke/payload /work/result; do
                attempt=$((attempt + 1))
                test "$attempt" -lt 30
                sleep 1
              done
          env:
            - {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
            - {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
            - {name: AWS_DEFAULT_REGION, value: us-east-1}
          volumeMounts:
            - {name: work, mountPath: /work}
      containers:
        - name: compare
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: ["cmp /fixture/payload /work/result && printf 'VersityGW transfer passed\\n'"]
          volumeMounts:
            - {name: fixture, mountPath: /fixture}
            - {name: work, mountPath: /work}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
      volumes:
        - name: fixture
          configMap: {name: probe-payload}
        - name: work
          emptyDir: {}