{{- if not .Values.secret.existingSecret }}
{{- $accessKey := .Values.secret.rustfs.access_key | default "" }}
{{- $secretKey := .Values.secret.rustfs.secret_key | default "" }}
{{- $allowInsecure := .Values.secret.allowInsecureDefaults | default false }}
{{/* Either key set to the well-known default counts as insecure. */}}
{{- $hasDefaultKey := or (eq $accessKey "rustfsadmin") (eq $secretKey "rustfsadmin") }}
{{- $bothEmpty := and (eq $accessKey "") (eq $secretKey "") }}
{{- $oneEmpty := and (not $bothEmpty) (or (eq $accessKey "") (eq $secretKey "")) }}
{{/* Always fail when only one of the two keys is supplied — never silently
     auto-fill a single missing key with the well-known default. */}}
{{- if $oneEmpty }}
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must both be set, or both be left empty. Setting only one of the two is ambiguous and is rejected to avoid silently using the well-known default for the missing key.") }}
{{- end }}
{{- if and (not $allowInsecure) (or $bothEmpty $hasDefaultKey) }}
{{- fail (printf "secret.rustfs.access_key and secret.rustfs.secret_key must be set to non-default, non-empty values, or set secret.existingSecret to a Secret you control. To opt into the well-known default credentials for local development only, set secret.allowInsecureDefaults=true.") }}
{{- end }}
{{- if and $allowInsecure $bothEmpty }}
{{- $accessKey = "rustfsadmin" }}
{{- $secretKey = "rustfsadmin" }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "rustfs.secretName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- toYaml .Values.commonLabels | nindent 4 }}
type: Opaque
data:
  RUSTFS_ACCESS_KEY: {{ $accessKey | b64enc | quote }}
  RUSTFS_SECRET_KEY: {{ $secretKey | b64enc | quote }}
{{- end }}

---
{{- if include "rustfs.kmsVaultToken" . }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "rustfs.kmsSecretName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- toYaml .Values.commonLabels | nindent 4 }}
type: Opaque
data:
  RUSTFS_KMS_VAULT_TOKEN: {{ include "rustfs.kmsVaultToken" . | b64enc | quote }}
{{- end }}

---
{{- if .Values.imageRegistryCredentials.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "rustfs.imagePullSecret.name" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- toYaml .Values.commonLabels | nindent 4 }}
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: {{ template "imagePullSecret" . }}
{{- end }}
