devspace.yaml

version: v2beta1

vars:
  AUTHORIZATION_NAMESPACE: platform
  AUTHORIZATION_SELECTOR: app.kubernetes.io/name=authorization

functions:
  disable_argocd_sync: |-
    if kubectl get application authorization -n argocd >/dev/null 2>&1; then
      echo "Disabling ArgoCD auto-sync for authorization..."
      kubectl patch application authorization -n argocd \
        --type merge \
        -p '{"spec":{"syncPolicy":{"automated":null}}}'
      echo "ArgoCD auto-sync disabled."
    else
      echo "WARNING: ArgoCD Application 'authorization' not found in argocd namespace."
    fi
  restore_argocd_sync: &restore_argocd_sync |-
    if kubectl get application authorization -n argocd >/dev/null 2>&1; then
      echo "Re-enabling ArgoCD auto-sync for authorization..."
      kubectl patch application authorization -n argocd \
        --type merge \
        -p '{"spec":{"syncPolicy":{"automated":{"prune":true,"selfHeal":true}}}}'
      echo "ArgoCD auto-sync restored."
    fi
  patch_deployment: |-
    echo "Patching authorization deployment for DevSpace..."
    deployment_name="$(kubectl get deployment -n "${AUTHORIZATION_NAMESPACE}" \
      -l "${AUTHORIZATION_SELECTOR}" \
      -o jsonpath='{.items[0].metadata.name}')"
    if [ -z "$deployment_name" ]; then
      echo "ERROR: authorization deployment not found for selector ${AUTHORIZATION_SELECTOR}" >&2
      exit 1
    fi
    kubectl patch deployment "$deployment_name" -n "${AUTHORIZATION_NAMESPACE}" --type strategic --patch "$(cat <<'EOF'
    spec:
      template:
        spec:
          securityContext:
            runAsUser: 1000
            fsGroup: 1000
          initContainers: []
          volumes:
            - name: data
              emptyDir: {}
          containers:
            - name: authorization
              image: ghcr.io/agynio/devcontainer-go:1 # dev container for source deploy
              workingDir: /opt/app/data
              livenessProbe: null
              readinessProbe: null
              startupProbe: null
              command:
                - sh
                - -c
                - |
                  set -eu
                  elapsed=0
                  while [ ! -f /opt/app/data/go.mod ]; do
                    sleep 1; elapsed=$((elapsed + 1))
                    [ "$elapsed" -ge 120 ] && { echo "ERROR: sync timeout" >&2; exit 1; }
                  done
                  buf generate buf.build/agynio/api --path agynio/api/authorization/v1
                  exec go run ./cmd/authorization
              volumeMounts:
                - name: data
                  mountPath: /opt/app/data
              resources:
                requests:
                  cpu: 500m
                  memory: 1Gi
                limits:
                  cpu: "2"
                  memory: 4Gi
              securityContext:
                runAsNonRoot: true
                runAsUser: 1000
                runAsGroup: 1000
                readOnlyRootFilesystem: false
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
                seccompProfile:
                  type: RuntimeDefault
    EOF
    )"

pipelines:
  dev:
    flags:
      - name: watch
        short: w
        description: "Keep DevSpace running and stream logs"
    run: |-
      disable_argocd_sync
      patch_deployment
      if [ "$(get_flag "watch")" == "true" ]; then
        start_dev --disable-pod-replace authorization
      else
        start_dev --disable-pod-replace authorization
        echo "Waiting for authorization to be healthy on :50051..."
        healthy=false
        pod_name=""
        container_name=""
        for _ in $(seq 1 150); do
          pod_name="$(kubectl get pod -n "${AUTHORIZATION_NAMESPACE}" \
            -l "${AUTHORIZATION_SELECTOR}" \
            --field-selector=status.phase=Running \
            -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
          if [ -z "$pod_name" ]; then
            kubectl get pods -n "${AUTHORIZATION_NAMESPACE}" -l "${AUTHORIZATION_SELECTOR}" -o wide || true
            sleep 2
            continue
          fi
          container_name="$(kubectl get pod -n "${AUTHORIZATION_NAMESPACE}" "$pod_name" \
            -o jsonpath='{.spec.containers[0].name}' 2>/dev/null || true)"
          if [ -z "$container_name" ]; then
            echo "ERROR: Could not resolve container name for pod $pod_name" >&2
            kubectl get pod -n "${AUTHORIZATION_NAMESPACE}" "$pod_name" -o jsonpath='{range .spec.containers[*]}{.name}{"\n"}{end}' || true
            sleep 2
            continue
          fi
          if kubectl exec -n "${AUTHORIZATION_NAMESPACE}" "$pod_name" -c "$container_name" -- bash -c 'echo >/dev/tcp/127.0.0.1/50051' >/dev/null 2>&1; then
            healthy=true
            break
          fi
          echo "Authorization health check failed in pod $pod_name container $container_name; pod containers:" >&2
          kubectl get pod -n "${AUTHORIZATION_NAMESPACE}" "$pod_name" -o jsonpath='{range .spec.containers[*]}{.name}{"\n"}{end}' || true
          sleep 2
        done
        if [ "$healthy" != "true" ]; then
          echo "ERROR: Authorization did not become healthy within 300s" >&2
          if [ -n "$pod_name" ] && [ -n "$container_name" ]; then
            kubectl logs -n "${AUTHORIZATION_NAMESPACE}" "$pod_name" -c "$container_name" --tail=50 || true
          fi
          exit 1
        fi
        echo "Dev environment ready. Stopping dev session."
        stop_dev authorization
      fi

hooks:
  - name: restore-argocd-auto-sync
    events:
      - after:dev:authorization
    command: bash
    args:
      - -c
      - *restore_argocd_sync

dev:
  authorization:
    namespace: ${AUTHORIZATION_NAMESPACE}
    labelSelector:
      app.kubernetes.io/name: authorization
    containers:
      authorization:
        container: authorization
        sync:
          - path: ./:/opt/app/data
            excludePaths:
              - .git/
              - .github/
              - .devspace/
              - /.gen/
              - /bootstrap/
              - /bin/
              - /build/
              - /coverage/
              - /dist/
              - /node_modules/
              - /vendor/
              - /tmp/
            uploadExcludePaths:
              - .git/
              - .github/
              - .devspace/
              - /.gen/
              - /bootstrap/
              - /bin/
              - /build/
              - /coverage/
              - /dist/
              - /node_modules/
              - /vendor/
              - /tmp/
            downloadExcludePaths:
              - .git/
              - .github/
              - .devspace/
              - /.gen/
              - /bootstrap/
              - /bin/
              - /build/
              - /coverage/
              - /dist/
              - /node_modules/
              - /vendor/
              - /tmp/
        logs:
          enabled: true
          lastLines: 200