1import * as _ from 'lodash-es'
2import { regCredSecName, regcredSecTempl } from '../dockRegF.mts'
3import { res1Action } from '../../k8sF/resActionsF/res1ActionF.mts'
4import { read2Resource } from '../../k8sF/read2ResourceF.mts'
5import { getKlusterCtx, type KubeResource } from '../../k8sF/ctxF/klusterCtxF.mts'
6import { getAction } from '../../ctxF/actionCtxF.mts'
7
8export const getImagePullSecrets = async () => {
9  const {dockreg_host, dockLanHost, cluster_name} = getKlusterCtx()
10  const action = getAction()
11  const resource = regcredSecTempl({dockreg_host, dockLanHost})
12
13  if (action != 'delete') {
14    await res1Action({action, resource, cluster_name})
15  }
16
17  return [{name: regCredSecName({dockreg_host})}]
18}
19
20/** Union a pull-secret into the default ServiceAccount's imagePullSecrets (idempotent, additive).
21 *  Multiple registries (dockreg + regcache) coexist without last-writer-wins clobbering. */
22export const ensureSaPullSecret = async ({secretName, action, cluster_name}: {
23  secretName: string, action?: string, cluster_name: string,
24}) => {
25  action ||= getAction()
26  if (action !== 'apply') return
27  const resource = await read2Resource({cluster_name, resource: {
28    apiVersion: 'v1', kind: 'ServiceAccount', metadata: {name: 'default'},
29  }}) as {imagePullSecrets?: {name: string}[]} | null | undefined
30  if (!resource) return
31  const existing = resource.imagePullSecrets || []
32  if (_.some(existing, ({name}) => name === secretName)) return
33  Object.assign(resource, {imagePullSecrets: [...existing, {name: secretName}]})
34  await res1Action({action, resource: resource as KubeResource, cluster_name})
35}
36