apiVersion: v1
kind: Pod
metadata:
  name: "{{ include "spire-server.fullname" . }}-test-connection"
  namespace: {{ include "spire-server.namespace" . }}
  labels:
    {{- include "spire-server.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": test
spec:
  securityContext:
    {{- toYaml .Values.podSecurityContext | nindent 4 }}
  containers:
    - name: curl
      image: cgr.dev/chainguard/bash:latest
      command: ['bash']
      args:
        - -c
        - |
          curl -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}'
          NOCA=$?
          curl -k -f -s 'https://{{ include "spire-server.fullname" . }}:{{ .Values.service.port }}'
          IGNORECA=$?
          echo $NOCA $IGNORECA
          if [ $NOCA -eq 60 -a $IGNORECA -eq 22 ]; then
            # We were able to connect to the server but didn't recognize the ca (60) and the page not found (22) because we're not using grpc
            exit 0
          fi
          exit 1
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
    {{- if eq (.Values.federation.enabled | toString) "true" }}
    - name: curl-federation-bundle-endpoint
      image: cgr.dev/chainguard/bash:latest
      command: ['curl']
      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
    {{- end }}
  restartPolicy: Never