apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: workloadidentities.azure.livewyer.io
  creationTimestamp: null
spec:
  compositeTypeRef:
    apiVersion: azure.livewyer.io/v1alpha1
    kind: WorkloadIdentity
  mode: Pipeline
  pipeline:
    - step: go-templating
      functionRef:
        name: upbound-function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        inline:
          template: >
            {{- $id := $.observed.composite.resource.metadata.name }}

            {{- $ns := default "default"
            $.observed.composite.resource.metadata.namespace }}

            {{- $annotations := default (dict)
            $.observed.composite.resource.metadata.annotations }}

            {{- $labels := default (dict)
            $.observed.composite.resource.metadata.labels }}

            {{- $spec := $.observed.composite.resource.spec }}


            ---


            apiVersion: managedidentity.azure.m.upbound.io/v1beta1

            kind: UserAssignedIdentity

            metadata:
              name: {{ $id }}
              namespace: {{ $ns }}
              annotations:
                {{ setResourceNameAnnotation (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id) }}
                {{- range $key, $value := $annotations }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
                workloadidentity.azure.livewyer.io/userassignedidentity: {{ $id }}
                {{- range $key, $value := $labels }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
            spec:
              {{- if $spec.providerConfigRef }}
              providerConfigRef: {{ toJson $spec.providerConfigRef }}
              {{- end }}
              {{- if $spec.deletionPolicy }}
              deletionPolicy: {{ $spec.deletionPolicy }}
              {{- end }}
              {{- if $spec.managementPolicies }}
              managementPolicies: {{ toJson $spec.managementPolicies }}
              {{- end }}
              {{- if $spec.publishConnectionDetailsTo }}
              publishConnectionDetailsTo: {{ toJson $spec.publishConnectionDetailsTo }}
              {{- end }}
              {{- if $spec.writeConnectionSecretsToNamespace }}
              writeConnectionSecretsToNamespace: {{ $spec.writeConnectionSecretsToNamespace }}
              {{- end }}
              forProvider:
                name: {{ $id }}
                location: {{ $spec.forProvider.location }}
                resourceGroupName: {{ $spec.forProvider.resourceGroupName }}
                {{- if $spec.forProvider.tags }}
                tags: {{ toJson $spec.forProvider.tags }}
                {{- end }}

            ---


            apiVersion: managedidentity.azure.m.upbound.io/v1beta1

            kind: FederatedIdentityCredential

            metadata:
              name: {{ $id }}
              namespace: {{ $ns }}
              annotations:
                {{ setResourceNameAnnotation (printf "federatedidentitycredential.workloadidentity.azure.livewyer.io/%s" $id) }}
                {{- range $key, $value := $annotations }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
                workloadidentity.azure.livewyer.io/federatedidentitycredential: {{ $id }}
                {{- range $key, $value := $labels }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
            spec:
              {{- if $spec.providerConfigRef }}
              providerConfigRef: {{ toJson $spec.providerConfigRef }}
              {{- end }}
              {{- if $spec.deletionPolicy }}
              deletionPolicy: {{ $spec.deletionPolicy }}
              {{- end }}
              {{- if $spec.managementPolicies }}
              managementPolicies: {{ toJson $spec.managementPolicies }}
              {{- end }}
              {{- if $spec.publishConnectionDetailsTo }}
              publishConnectionDetailsTo: {{ toJson $spec.publishConnectionDetailsTo }}
              {{- end }}
              {{- if $spec.writeConnectionSecretsToNamespace }}
              writeConnectionSecretsToNamespace: {{ $spec.writeConnectionSecretsToNamespace }}
              {{- end }}
              forProvider:
                resourceGroupName: {{ $spec.forProvider.resourceGroupName }}
                audience:
                  - api://AzureADTokenExchange
                issuer: {{ $spec.forProvider.oidcIssuerURL }}
                parentIdRef:
                  name: {{ $id }}
                  namespace: {{ $ns }}
                subject: {{ printf "system:serviceaccount:%s:%s" $ns $spec.forProvider.serviceAccountName }}

            ---

            {{- range $i, $roleAssign := $spec.forProvider.roleAssignments }}

            {{- $roleId := printf "%s-role-%d-%s" $id $i (lower
            $roleAssign.roleDefinitionName | kebabcase) }}

            {{- if $roleAssign.permissions }}

            ---


            apiVersion: authorization.azure.m.upbound.io/v1beta1

            kind: RoleDefinition

            metadata:
              name: {{ $roleId }}
              namespace: {{ $ns }}
              annotations:
                {{ setResourceNameAnnotation (printf "roledefinition.workloadidentity.azure.livewyer.io/%s" $roleId) }}
                {{- range $key, $value := $annotations }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
                workloadidentity.azure.livewyer.io/roledefinition: {{ $roleId }}
                {{- range $key, $value := $labels }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
            spec:
              {{- if $spec.providerConfigRef }}
              providerConfigRef: {{ toJson $spec.providerConfigRef }}
              {{- end }}
              {{- if $spec.deletionPolicy }}
              deletionPolicy: {{ $spec.deletionPolicy }}
              {{- end }}
              {{- if $spec.managementPolicies }}
              managementPolicies: {{ toJson $spec.managementPolicies }}
              {{- end }}
              {{- if $spec.publishConnectionDetailsTo }}
              publishConnectionDetailsTo: {{ toJson $spec.publishConnectionDetailsTo }}
              {{- end }}
              {{- if $spec.writeConnectionSecretsToNamespace }}
              writeConnectionSecretsToNamespace: {{ $spec.writeConnectionSecretsToNamespace }}
              {{- end }}
              forProvider:
                name: {{ $roleAssign.roleDefinitionName }}
                {{- if $roleAssign.scopeRef }}
                scopeRef: {{ toJson $roleAssign.scopeRef }}
                {{- else }}
                scope: {{ $roleAssign.scope }}
                {{- end }}
                {{- if $roleAssign.assignableScopes }}
                assignableScopes: {{ $roleAssign.assignableScopes }}
                {{- end }}
                {{- if $roleAssign.assignableScopesRefs }}
                assignableScopesRefs: {{ toJson $roleAssign.assignableScopesRefs }}
                {{- end }}
                {{- if $roleAssign.description }}
                description: {{ $roleAssign.description }}
                {{- end }}
                {{- if $roleAssign.roleDefinitionId }}
                roleDefinitionId: {{ $roleAssign.roleDefinitionId }}
                {{- end }}
                permissions: {{ toJson $roleAssign.permissions }}

            ---

            {{- end }}

            ---


            apiVersion: authorization.azure.m.upbound.io/v1beta1

            kind: RoleAssignment

            metadata:
              name: {{ $roleId }}
              namespace: {{ $ns }}
              annotations:
                {{ setResourceNameAnnotation (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) }}
                {{- range $key, $value := $annotations }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
                workloadidentity.azure.livewyer.io/roleassignment: {{ $roleId }}
                {{- range $key, $value := $labels }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
            spec:
              {{- if $spec.providerConfigRef }}
              providerConfigRef: {{ toJson $spec.providerConfigRef }}
              {{- end }}
              {{- if $spec.deletionPolicy }}
              deletionPolicy: {{ $spec.deletionPolicy }}
              {{- end }}
              {{- if $spec.managementPolicies }}
              managementPolicies: {{ toJson $spec.managementPolicies }}
              {{- end }}
              {{- if $spec.publishConnectionDetailsTo }}
              publishConnectionDetailsTo: {{ toJson $spec.publishConnectionDetailsTo }}
              {{- end }}
              {{- if $spec.writeConnectionSecretsToNamespace }}
              writeConnectionSecretsToNamespace: {{ $spec.writeConnectionSecretsToNamespace }}
              {{- end }}
              forProvider:
                scope: {{ $roleAssign.scope }}
                principalId: {{ dig "resources" (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id) "resource" "status" "atProvider" "principalId" "" $.observed }}
                {{- if $roleAssign.description }}
                description: {{ $roleAssign.description }}
                {{- end }}
                {{- if $roleAssign.principalType }}
                principalType: {{ $roleAssign.principalType }}
                {{- end }}
                {{- if $roleAssign.condition }}
                condition: {{ $roleAssign.condition }}
                {{- end }}
                {{- if $roleAssign.conditionVersion }}
                conditionVersion: {{ $roleAssign.conditionVersion }}
                {{- end }}
                {{- if $roleAssign.permissions }}
                roleDefinitionIdRef:
                  name: {{ $roleId }}
                  namespace: {{ $ns }}
                {{- else }}
                roleDefinitionName: {{ $roleAssign.roleDefinitionName }}
                {{- end }}

            ---

            {{- end }}

            {{- if $spec.forProvider.serviceAccountName }}

            ---


            apiVersion: kubernetes.m.crossplane.io/v1alpha1

            kind: Object

            metadata:
              name: {{ $spec.forProvider.serviceAccountName }}
              namespace: {{ $ns }}
              annotations:
                {{ setResourceNameAnnotation (printf "serviceaccount.workloadidentity.azure.livewyer.io/%s" $spec.forProvider.serviceAccountName) }}
                {{- range $key, $value := $annotations }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
                workloadidentity.azure.livewyer.io/serviceaccount: {{ $spec.forProvider.serviceAccountName }}
                azure.workload.identity/use: "true"
                {{- range $key, $value := $labels }}
                {{ $key }}: "{{ $value }}"
                {{- end }}
            spec:
              forProvider:
                manifest:
                  apiVersion: v1
                  kind: ServiceAccount
                  metadata:
                    name: {{ $spec.forProvider.serviceAccountName }}
                    namespace: {{ $ns }}
                    annotations:
                      azure.workload.identity/client-id: {{ default (toString "''") (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.clientId }}
                      azure.workload.identity/tenant-id: {{ default (toString "''") (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.tenantId }}
                      azure.workload.identity/service-account-token-expiration: {{ default (toString "'86400'") $spec.forProvider.serviceAccountTokenExpiration }}
                      {{- range $key, $value := $annotations }}
                      {{ $key }}: "{{ $value }}"
                      {{- end }}
                    labels:
                      azure.livewyer.io/workloadidentity: {{ $id }}
                      workloadidentity.azure.livewyer.io/serviceaccount: {{ $spec.forProvider.serviceAccountName }}
                      azure.workload.identity/use: "true"
                      {{- range $key, $value := $labels }}
                      {{ $key }}: "{{ $value }}"
                      {{- end }}

            ---

            {{- end }}

            ---


            apiVersion: {{ .observed.composite.resource.apiVersion }}

            kind: {{ .observed.composite.resource.kind }}

            metadata:
              name: {{ $id }}
              namespace: {{ $ns }}
              labels:
                azure.livewyer.io/workloadidentity: {{ $id }}
            status:
              atProvider:
                location: {{ (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.location }}
                resourceGroupName: {{ (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.resourceGroupName }}
                oidcIssuerURL: {{ (getComposedResource . (printf "federatedidentitycredential.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.issuer }}
                clientId: {{ (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.clientId }}
                tenantId: {{ (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.tenantId }}
                principalId: {{ (getComposedResource . (printf "userassignedidentity.workloadidentity.azure.livewyer.io/%s" $id)).status.atProvider.principalId }}
                roleAssignments:
                  {{- range $i, $roleAssign := $spec.forProvider.roleAssignments }}
                  {{- $roleId := printf "%s-role-%d-%s" $id $i (lower $roleAssign.roleDefinitionName) }}
                  {{- if $roleAssign.permissions }}
                  - scope: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "scope" "" $.observed }}
                    roleDefinitionId: {{ dig "resources" (printf "roledefinition.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "id" "" $.observed }}
                    roleDefinitionName: {{ dig "resources" (printf "roledefinition.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "name" "" $.observed }}
                    roleAssignmentId: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "id" "" $.observed }}
                    roleAssignmentName: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "name" "" $.observed }}
                    permissions: {{ toJson (dig "resources" (printf "roledefinition.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "permissions" (list) $.observed) }}
                  {{- else }}
                  - scope: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "scope" "" $.observed }}
                    roleDefinitionName: {{ $roleAssign.roleDefinitionName }}
                    roleAssignmentId: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "id" "" $.observed }}
                    roleAssignmentName: {{ dig "resources" (printf "roleassignment.workloadidentity.azure.livewyer.io/%s" $roleId) "resource" "status" "atProvider" "name" "" $.observed }}
                  {{- end }}
                  {{- end }}

            ---
        kind: GoTemplate
        source: Inline
    - step: automatically-detect-ready-composed-resources
      functionRef:
        name: upbound-function-auto-ready