package cluster

import (
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/types"

	"github.com/tidbcloud/infra-api/pkg/consts"
	"github.com/tidbcloud/infra-api/pkg/k8s"
)

// createServiceAccountForBR copies GCP Application Default Credentials secret
// from tidb-operator namespace to the tidb cluster namespace for Backup and Restore.
func (r *reconcileContext) copySecretForBR(ns string) error {
	secretName := consts.BRGCPSecretName
	secret := &corev1.Secret{}
	namespacedName := types.NamespacedName{
		Namespace: consts.LocalOperatorNamespace,
		Name:      secretName,
	}
	err := r.shootClient.Get(r.ctx, namespacedName, secret)
	if err != nil {
		return err
	}

	secretCopy := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      secretName,
			Namespace: ns,
		},
		Data: secret.Data,
		Type: corev1.SecretTypeOpaque,
	}

	_, err = k8s.CreateIgnoreExists(r.ctx, r.shootClient, secretCopy)
	return err
}