#!/usr/bin/env bash
set -euo pipefail

PROJECT=${PROJECT:-}
if [[ -z $PROJECT ]] ; then
	echo "PROJECT must be set. Usually this is set to your user $USER" >&2
	exit 1
fi

# Switch to the gardener cluster
if ! kubectl ctx garden ; then
	echo "could not switch to the garden ctx"
	exit 1
fi

# Create the gardener project
if ! kubectl get ns "garden-${PROJECT}" ; then
cat <<EOF | kubectl create -f -
apiVersion: core.gardener.cloud/v1beta1
kind: Project
metadata:
  name: ${PROJECT}
spec:
  namespace: garden-${PROJECT}
  owner:
    apiGroup: rbac.authorization.k8s.io
    kind: User
    name: cloud@pingcap.com
EOF
fi

# Create secret and secretbindings for AWS
if !  kubectl -n "garden-${PROJECT}" get secret aws ; then
	kubectl -n "garden-${PROJECT}" create secret generic aws --from-literal=accessKeyID='' --from-literal=secretAccessKey=''
fi

if ! kubectl get -n "garden-${PROJECT}" secretbinding aws ; then
cat <<EOF | kubectl create -f -
apiVersion: core.gardener.cloud/v1beta1
kind: SecretBinding
metadata:
  labels:
    cloudprofile.garden.sapcloud.io/name: aws
  name: aws
  namespace: garden-${PROJECT}
secretRef:
  name: aws
  namespace: garden-${PROJECT}
EOF
fi


# Create secret and secretbindings for GCP.
# See https://cloud.google.com/iam/docs/creating-managing-service-account-keys for helps.
if ! kubectl -n "garden-${PROJECT}" get secret gcp ; then
	kubectl -n garden-nightly get secret gcp -o yaml | sed "s/namespace: garden-nightly/namespace: garden-${PROJECT}/g" | kubectl -n garden-${PROJECT} apply -f -
fi


if ! kubectl get -n "garden-${PROJECT}" secretbinding gcp ; then
cat <<EOF | kubectl create -f -
apiVersion: core.gardener.cloud/v1beta1
kind: SecretBinding
metadata:
  labels:
    cloudprofile.garden.sapcloud.io/name: gcp
  name: gcp
  namespace: garden-${PROJECT}
secretRef:
  name: gcp
  namespace: garden-${PROJECT}
EOF
fi