#!/usr/bin/env python3
"""为四个命名空间里非空的 Opaque Secret 生成 ExternalSecret。

目标 Secret 名保持原样，Deployment 的 envFrom 不用改，Pod 也不会因此滚动。
"""
import json
import subprocess

NAMESPACES = ["llm", "dify", "langfuse", "observability"]
HEADER = """apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {name}
  namespace: {ns}
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: {name}
    creationPolicy: Merge
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: apps/{ns}/{name}
"""


def main():
    docs = []
    for ns in NAMESPACES:
        raw = subprocess.check_output(["kubectl", "-n", ns, "get", "secret", "-o", "json"])
        for item in json.loads(raw)["items"]:
            name = item["metadata"]["name"]
            if item.get("type") != "Opaque" or name.startswith("sh.helm.release"):
                continue
            if not item.get("data"):
                print(f"SKIP {ns}/{name} empty")
                continue
            docs.append(HEADER.format(ns=ns, name=name).strip())
            print(f"ADD {ns}/{name}")
    path = "/tmp/external-secrets-all.yaml"
    with open(path, "w", encoding="utf-8") as handle:
        handle.write("\n---\n".join(docs) + "\n")
    subprocess.check_call(["kubectl", "apply", "-f", path])
    print(f"APPLIED {len(docs)}")


if __name__ == "__main__":
    main()