package network

import (
	"context"
	"fmt"

	corev1 "k8s.io/api/core/v1"
	"sigs.k8s.io/controller-runtime/pkg/client"

	cloudv1 "github.com/tidbcloud/infra-api/api/v1"
	"github.com/tidbcloud/shared-provider/pkg/utils/namespace"
)

func (r *Reconciler) syncDefaultSA(ctx context.Context, net *cloudv1.Network) error {
	ns := namespace.GetOwnedNamespaceNameFromNetwork(net)
	sa := &corev1.ServiceAccount{}

	if err := r.Cache.Get(ctx, client.ObjectKey{Namespace: ns, Name: "default"}, sa); err != nil {
		// if `IsNotFound`, then we still need to wait for the SA to be created.
		return fmt.Errorf("can't get default service account: %v", err)
	}

	if sa.AutomountServiceAccountToken != nil && !*sa.AutomountServiceAccountToken {
		return nil // no need to update
	}
	var automount = false
	sa.AutomountServiceAccountToken = &automount
	if err := r.Client.Update(ctx, sa); err != nil {
		return fmt.Errorf("can't update default service account: %v", err)
	}

	return nil
}