# =============================================================================
# L2 BEHAVIORAL — IdP datastore is DR-critical  (R-IDP-05)              [RUNNABLE]
# Spec: docs/15 identity-and-access; ADR-0014. Impl: platform/keycloak/postgres-cluster.yaml
# (CloudNativePG Cluster on the 3-replica `longhorn` StorageClass).
#
# GIVEN Keycloak's PostgreSQL runs as a CloudNativePG Cluster,
# WHEN  we inspect it
#   ->  THEN it is healthy (>=1 ready instance) AND its data lives on the replicated `longhorn`
#       StorageClass — i.e. the identity datastore is DR-critical / replicated (R-IDP-05). Keycloak is
#       stateless and rebuilds from this DB + the git realm import.
# (Full off-cluster backup/restore is R-STATE-03/Velero territory, hand-off OQ-BKP.)
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: keycloak-db-dr
  labels:
    conformance.home.k3s/R-IDP-05: "true"
  annotations:
    conformance.home.k3s/requirements: "R-IDP-05"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Keycloak's CloudNativePG database is healthy and stored on the 3-replica longhorn StorageClass.
spec:
  timeouts:
    exec: 5m
  steps:
    - name: db-cluster-is-healthy
      try:
        - script:
            content: |
              set -u
              for i in $(seq 1 30); do
                ready="$(kubectl -n keycloak get clusters.postgresql.cnpg.io keycloak-db \
                          -o jsonpath='{.status.readyInstances}' 2>/dev/null || true)"
                echo "poll $i: readyInstances=$ready"
                if [ "${ready:-0}" -ge 1 ]; then echo DB_READY_OK; break; fi
                sleep 10
              done
            check:
              (contains($stdout, 'DB_READY_OK')): true
    - name: db-data-is-on-replicated-longhorn
      try:
        - script:
            content: |
              set -u
              sc="$(kubectl -n keycloak get pvc -l cnpg.io/cluster=keycloak-db \
                      -o jsonpath='{.items[0].spec.storageClassName}' 2>/dev/null || true)"
              echo "db pvc storageClass=$sc"
              if [ "$sc" = "longhorn" ]; then
                echo DB_ON_LONGHORN_OK
              else
                echo "FAIL: Keycloak DB PVC not on the replicated longhorn StorageClass"; exit 1
              fi
            check:
              (contains($stdout, 'DB_ON_LONGHORN_OK')): true