apiVersion: batch/v1
kind: Job
metadata:
  name: azure-image-creation
  namespace: openshift-sandboxed-containers-operator
spec:
  parallelism: 1
  completions: 1
  backoffLimit: 1
  template:
    metadata:
      name: azure-image-creation
    spec:
      containers:
      - command:
        - /bin/sh
        - -c
        - |
          set -e
          rpm --import https://packages.microsoft.com/keys/microsoft.asc
          dnf install -y https://packages.microsoft.com/config/rhel/9.0/packages-microsoft-prod.rpm
          dnf install -y make git azure-cli unzip
          curl https://releases.hashicorp.com/packer/1.9.4/packer_1.9.4_linux_amd64.zip -o packer_1.9.4_linux_amd64.zip
          echo "6cd5269c4245aa8c99e551d1b862460d63fe711c58bec618fade25f8492e80d9  packer_1.9.4_linux_amd64.zip" | sha256sum -c
          unzip packer_1.9.4_linux_amd64.zip -d /usr/bin/
          PATH="/usr/bin:${PATH}"
          curl -L https://github.com/mikefarah/yq/releases/download/v4.35.2/yq_linux_amd64 -o /usr/bin/yq # TODO: remove?
          echo "8afd786b3b8ba8053409c5e7d154403e2d4ed4cf3e93c237462dc9ef75f38c8d /usr/bin/yq" | sha256sum -c
          chmod +x /usr/bin/yq
          git clone https://github.com/confidential-containers/cloud-api-adaptor.git && (cd cloud-api-adaptor && git checkout 90ccfc3fa0ee56c2fc61b23ecf3731f819faf875)
          [ "$BOOT_FIPS" == "true" ] && sed -i '/exit 0/ifips-mode-setup --enable' cloud-api-adaptor/azure/image/misc-settings.sh
          tar xvf /payload/podvm-binaries.tar.gz -C cloud-api-adaptor/podvm/files
          mkdir cloud-api-adaptor/podvm/files/pause_bundle # workaround to avoid pause image requirement
          [[ ! "${AZURE_REGION}" ]] && echo "AZURE_REGION is missing" && exit 1
          [[ ! "${AZURE_TENANT_ID}" ]] && echo "AZURE_TENANT_ID is missing" && exit 1
          [[ ! "${AZURE_RESOURCE_GROUP}" ]] && echo "AZURE_RESOURCE_GROUP is missing" && exit 1
          [[ ! "${AZURE_SUBSCRIPTION_ID}" ]] && echo "AZURE_SUBSCRIPTION_ID is missing" && exit 1
          [[ ! "${AZURE_CLIENT_SECRET}" ]] && echo "AZURE_CLIENT_SECRET is missing" && exit 1
          [[ ! "${AZURE_CLIENT_ID}" ]] && echo "AZURE_CLIENT_ID is missing" && exit 1
          export PKR_VAR_client_id=${AZURE_CLIENT_ID}
          export PKR_VAR_client_secret=${AZURE_CLIENT_SECRET}
          export PKR_VAR_subscription_id=${AZURE_SUBSCRIPTION_ID}
          export PKR_VAR_tenant_id=${AZURE_TENANT_ID}
          export PKR_VAR_resource_group=${AZURE_RESOURCE_GROUP}
          export PKR_VAR_location=${AZURE_LOCATION}
          export PKR_VAR_az_image_name=${IMAGE_NAME}
          export PKR_VAR_vm_size=${VM_SIZE:-Standard_A2_v2}
          export PKR_VAR_ssh_username=${SSH_USERNAME:-peerpod}
          export PKR_VAR_publisher=${PUBLISHER}
          export PKR_VAR_offer=${OFFER}
          export PKR_VAR_sku=${SKU}
          export PKR_VAR_plan_name=${PLAN_NAME}
          export PKR_VAR_plan_product=${PLAN_PRODUCT}
          export PKR_VAR_plan_publisher=${PLAN_PUBLISHER}
          cd cloud-api-adaptor/azure/image
          packer init ${PODVM_DISTRO}/
          make BINARIES= PAUSE_BUNDLE= image && \
          az login --service-principal --user=${AZURE_CLIENT_ID} --password=${AZURE_CLIENT_SECRET} --tenant=${AZURE_TENANT_ID} && \
          AZURE_IMAGE_ID=$(az image list --resource-group ${AZURE_RESOURCE_GROUP} --query "[].{Id: id} | [? contains(Id, '${IMAGE_NAME}')]" --output tsv) && \
          echo ${AZURE_IMAGE_ID} >> /output/image-id
          echo "DONE: ${AZURE_IMAGE_ID}"
        env:
        - name: PODVM_DISTRO
          value: rhel
        - name: PUBLISHER
          value: RedHat
        - name: OFFER
          value: rhel-raw
        - name: SKU
          value: "9_2"
        - name: IMAGE_NAME
          value: peer-pod-vmimage
        envFrom:
        - secretRef:
            name: peer-pods-secret
        - configMapRef:
            name: peer-pods-cm
            optional: true
        image: registry.access.redhat.com/ubi9/ubi:9.2
        imagePullPolicy: IfNotPresent
        name: create
        resources: {}
        securityContext:
          runAsUser: 0
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /payload
          name: shared-data
        - mountPath: /output
          name: image-id
      - command:
        - /bin/sh
        - -c
        - |
          while  [ ! -f /output/image-id  ]; do sleep 5; done
          cat /output/image-id
        envFrom:
        - secretRef:
            name: peer-pods-secret
        - configMapRef:
            name: peer-pods-cm
            optional: true
        image: registry.access.redhat.com/ubi9/ubi:9.2
        imagePullPolicy: IfNotPresent
        name: result
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /output
          name: image-id
      dnsPolicy: ClusterFirst
      initContainers:
      - args:
        - -c
        - cp /podvm-binaries.tar.gz /payload/
        command:
        - /bin/sh
        image: registry.redhat.io/openshift-sandboxed-containers/osc-podvm-payload-rhel9:latest
        imagePullPolicy: Always
        name: payload
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /payload
          name: shared-data
      restartPolicy: Never
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - emptyDir: {}
        name: shared-data
      - emptyDir: {}
        name: image-id
