# Synthetic marker fixture only. Namespace/ServiceAccount are created in step 4.
apiVersion: api.cloudtaser.io/v1alpha1
kind: CloudTaserPolicy
metadata:
  name: protected-reader
  namespace: payments
spec:
  vaultPaths:
    - secret/data/payments/credentials
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: protected-reader
  namespace: payments
spec:
  replicas: 1
  selector:
    matchLabels:
      app: protected-reader
  template:
    metadata:
      labels:
        app: protected-reader
      annotations:
        secretstore.cloudtaser.io/inject: "true"
        cloudtaser.io/secretstore-auth-method: "token"
        cloudtaser.io/secret-paths: "secret/data/payments/credentials"
        cloudtaser.io/env-map: "marker=CT_TEST_MARKER"
        cloudtaser.io/rotation: "restart"
        cloudtaser.io/containers: "app"
    spec:
      serviceAccountName: reader
      containers:
        - name: app
          image: docker.io/library/python@sha256:2d44738ebf4ce5f63b9d9ea871e9c7cfdc0426f7b0c97cac915fd88ded1d86bb
          command: [python3, -u, -c]
          args:
            - |
              import ctypes
              import hashlib
              import json
              from http.server import BaseHTTPRequestHandler, HTTPServer
              from urllib.parse import parse_qs, urlsplit

              libc = ctypes.CDLL(None)
              libc.getenv.argtypes = [ctypes.c_char_p]
              libc.getenv.restype = ctypes.c_char_p
              marker = libc.getenv(b"CT_TEST_MARKER")
              if not marker:
                  raise SystemExit("synthetic marker unavailable")
              digest = hashlib.sha256(marker).hexdigest()
              del marker

              class Handler(BaseHTTPRequestHandler):
                  def do_GET(self):
                      request = urlsplit(self.path)
                      if request.path == "/status":
                          result = {"marker_sha256": digest}
                      elif request.path == "/compare":
                          expected = parse_qs(request.query).get("sha256", [""])[0]
                          result = {"matches": expected == digest}
                      else:
                          self.send_error(404)
                          return
                      body = json.dumps(result).encode()
                      self.send_response(200)
                      self.send_header("Content-Type", "application/json")
                      self.send_header("Content-Length", str(len(body)))
                      self.end_headers()
                      self.wfile.write(body)

                  def log_message(self, *_):
                      pass

              HTTPServer(("0.0.0.0", 8080), Handler).serve_forever()
          ports:
            - name: status
              containerPort: 8080
          readinessProbe:
            httpGet:
              path: /status
              port: status
            periodSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
  name: protected-reader
  namespace: payments
spec:
  selector:
    app: protected-reader
  ports:
    - name: status
      port: 8080
      targetPort: status