# store the secret-name as variable
{{- $secret_name := "connect-secrets" -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: "{{ $secret_name }}"
  annotations:
    "helm.sh/resource-policy": "keep"
data:
  # try to get the old secrets
  # keep in mind, that a dry-run only returns an empty map
  {{- $previous := lookup "v1" "Secret" .Release.Namespace $secret_name }}

  # check, if a secret is already set
  {{- if or (not $previous) (not $previous.data) }}
  # if not set, then generate a new password
  JWT_SECRET: "{{ .Values.connect.jwt.secret | b64enc }}"
  ADMIN_PASSWORD: "{{ .Values.connect.admin.password | b64enc }}"
  DATASOURCE_USERNAME: "{{ .Values.connect.database.username | b64enc }}"
  DATASOURCE_PASSWORD: "{{ .Values.connect.database.password | b64enc }}"
  ELASTIC_USERNAME: "{{ .Values.connect.elastic.username | b64enc }}"
  ELASTIC_PASSWORD: "{{ .Values.connect.elastic.password | b64enc }}"
  OIDC_CLIENT_SECRET: "{{ .Values.connect.oidc.client_secret | b64enc }}"
  MAIL_USER: "{{ .Values.connect.mail.username | b64enc }}"
  MAIL_PASSWORD: "{{ .Values.connect.mail.password | b64enc }}"
  {{ else }}
  # if set, then use the old value
  JWT_SECRET: "{{ index $previous.data "JWT_SECRET" }}"
  ADMIN_PASSWORD: "{{ index $previous.data "ADMIN_PASSWORD" }}"
  DATASOURCE_USERNAME: "{{ index $previous.data "DATASOURCE_USERNAME" }}"
  DATASOURCE_PASSWORD: "{{ index $previous.data "DATASOURCE_PASSWORD" }}"
  ELASTIC_USERNAME: "{{ index $previous.data "ELASTIC_USERNAME" }}"
  ELASTIC_PASSWORD: "{{ index $previous.data "ELASTIC_PASSWORD" }}"
  OIDC_CLIENT_SECRET: "{{ index $previous.data "OIDC_CLIENT_SECRET" }}"
  MAIL_USER: "{{ index $previous.data "MAIL_USER" }}"
  MAIL_PASSWORD: "{{ index $previous.data "MAIL_PASSWORD" }}"
  {{ end }}