---
apiVersion: shipwright.io/v1alpha1
kind: ClusterBuildStrategy
metadata:
  name: source-to-image-multi
spec:
  volumes:
    - name: s2i
      emptyDir: {}
    - name: etc-pki-entitlement
      emptyDir: {}
      overridable: true
  buildSteps:
    - name: s2i-generate
      image: registry.redhat.io/source-to-image/source-to-image-rhel8:1.4.1
      workingDir: $(params.shp-source-root)
      command: 
        - /usr/local/bin/s2i
      args:
        - build
        - $(params.shp-source-context)
        - $(build.builder.image)
        - $(params.shp-output-image)
        - --as-dockerfile=/s2i/Dockerfile
      volumeMounts:
        - name: s2i
          mountPath: /s2i
        - mountPath: /etc/pki/entitlement
          name: etc-pki-entitlement
    - name: buildah
      image: registry.redhat.io/ubi8/buildah:8.10-9
      workingDir: /s2i
      securityContext:
        capabilities:
          add:
          - "SETFCAP"
      command:
        - /bin/bash
      args:
        - -c
        - |
          set -euo pipefail

          # Parse parameters
          image=
          target=
          registriesBlock=""
          inRegistriesBlock=false
          registriesInsecure=""
          inRegistriesInsecure=false
          registriesSearch=""
          inRegistriesSearch=false
          while [[ $# -gt 0 ]]; do
            arg="$1"
            shift

            if [ "${arg}" == "--image" ]; then
              inRegistriesBlock=false
              inRegistriesInsecure=false
              inRegistriesSearch=false
              image="$1"
              shift
            elif [ "${arg}" == "--target" ]; then
              inBuildArgs=false
              inRegistriesBlock=false
              inRegistriesInsecure=false
              inRegistriesSearch=false
              target="$1"
              shift
            elif [ "${arg}" == "--registries-block" ]; then
              inRegistriesBlock=true
              inRegistriesInsecure=false
              inRegistriesSearch=false
            elif [ "${arg}" == "--registries-insecure" ]; then
              inRegistriesInsecure=true
              inRegistriesBlock=false
              inRegistriesSearch=false
            elif [ "${arg}" == "--registries-search" ]; then
              inRegistriesSearch=true
              inRegistriesBlock=false
              inRegistriesInsecure=false
            elif [ "${inRegistriesBlock}" == "true" ]; then
              registriesBlock="${registriesBlock}'${arg}', "
            elif [ "${inRegistriesInsecure}" == "true" ]; then
              registriesInsecure="${registriesInsecure}'${arg}', "
            elif [ "${inRegistriesSearch}" == "true" ]; then
              registriesSearch="${registriesSearch}'${arg}', "
            else
              echo "Invalid usage"
              exit 1
            fi
          done

          echo "[INFO] Creating registries config file..."
          if [ "${registriesSearch}" != "" ]; then
            cat <<EOF >>/tmp/registries.conf
          [registries.search]
          registries = [${registriesSearch::-2}]

          EOF
          fi
          if [ "${registriesInsecure}" != "" ]; then
            cat <<EOF >>/tmp/registries.conf
          [registries.insecure]
          registries = [${registriesInsecure::-2}]

          EOF
          fi
          if [ "${registriesBlock}" != "" ]; then
            cat <<EOF >>/tmp/registries.conf
          [registries.block]
          registries = [${registriesBlock::-2}]

          EOF
          fi

          # Building the image
          echo "[INFO] Building image ${image}"
          buildah --storage-driver=$(params.storage-driver) bud \
            --registries-conf=/tmp/registries.conf \
            --tag="${image}"

          # Push the image
          echo "[INFO] Pushing image ${image}"
          buildah --storage-driver=$(params.storage-driver) push \
            --digestfile='$(results.shp-image-digest.path)' \
            "${image}" \
            "docker://${image}"
        # That's the separator between the shell script and its args
        - --
        - --image
        - $(params.shp-output-image)
        - --registries-block
        - $(params.registries-block[*])
        - --registries-insecure
        - $(params.registries-insecure[*])
        - --registries-search
        - $(params.registries-search[*])
      volumeMounts:
        - name: s2i
          mountPath: /s2i
        - mountPath: /etc/pki/entitlement
          name: etc-pki-entitlement
  parameters:
    - name: registries-block
      description: The registries that need to block pull access.
      type: array
      defaults: []
    - name: registries-insecure
      description: The fully-qualified name of insecure registries. An insecure registry is one that does not have a valid SSL certificate or only supports HTTP.
      type: array
      defaults: []
    - name: registries-search
      description: The registries for searching short name images such as `golang:latest`.
      type: array
      defaults:
        - registry.redhat.io
        - quay.io
    - name: storage-driver
      description: "The storage driver to use, such as 'overlay' or 'vfs'."
      type: string
      default: "vfs"
      # For details see the "--storage-driver" section of https://github.com/containers/buildah/blob/main/docs/buildah.1.md#options
  securityContext:
    runAsUser: 0
    runAsGroup: 0
