#!/bin/sh
# Migration 42 --> 43
# Backfill the platform.cozystack.io/no-delete=true label on the
# cozystack-version ConfigMap so the deletion-protection
# ValidatingAdmissionPolicy guards it on upgraded clusters.
#
# On first install the chart template renders the ConfigMap with the
# label inline. On upgrades the template skips re-rendering (lookup-if-not
# preserves migration-managed data.version), so the label needs an
# explicit one-shot backfill here.
#
# Idempotent: kubectl apply re-runs are a no-op once the ConfigMap matches
# the declared shape. Same label set the chart bakes in at install time, so
# the next chart-driven apply sees no diff.
#
# 3-way-merge note: this apply records the no-delete label in the kubectl
# last-applied-configuration annotation under the default field manager.
# Any future migration that re-stamps cozystack-version via the same field
# manager MUST include the label inline (matching the chart template at
# templates/cozystack-version.yaml) — a label-less apply by the same field
# manager would strip it.

set -euo pipefail

NAMESPACE="${NAMESPACE:-cozy-system}"
DRY_RUN="${MIGRATION_DRY_RUN:-0}"

MANIFEST=$(cat <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: cozystack-version
  namespace: ${NAMESPACE}
  labels:
    platform.cozystack.io/no-delete: "true"
data:
  version: "43"
EOF
)

if [ "$DRY_RUN" = "1" ]; then
  echo "[dry-run] would apply:"
  printf '%s\n' "$MANIFEST"
  echo "Dry-run complete; version stamp not advanced"
  exit 0
fi

printf '%s\n' "$MANIFEST" | kubectl apply --filename -
echo "Applied configmap $NAMESPACE/cozystack-version with deletion-protection label"
