#!/usr/bin/env bash

set -euo pipefail
# When changing this script, remember to modify the corresponding github action
region=${1}
env=${2}
cloud=${3}
json_file_path=${4}
logicalRegionName=${5}

additional_args=$(jq -r '.' "${json_file_path}")

echo "additional_args: ${additional_args}"

irsa_role_arn=$(echo ${additional_args} | jq -r '.awsIrsaRoleArn')
default_aws_dp4drs_role=$(echo ${additional_args} | jq -r '.defaultAwsDp4DrsRole')
assume_role_global_arn=$(echo ${additional_args} | jq -r '.awsAssumeRoleGlobalArn')
eks_service_role_name=$(echo ${additional_args} | jq -r '.eksServiceRoleName')
default_aws_acount=$(echo ${additional_args} | jq -r '.defaultAwsAccount')
availability_zones=$(echo ${additional_args} | jq -r '.availabilityZones')
image_registry=$(echo ${additional_args} | jq -r '.imageRegistry')
cluster_controller_assume_role_name=$(echo ${additional_args} | jq -r '.clusterControllerAssumeRoleName')
readonly_cluster_controller_assume_role_name=$(echo ${additional_args} | jq -r '.readonlyClusterControllerAssumeRoleName')
dp_controller_assume_role_name=$(echo ${additional_args} | jq -r '.dpControllerAssumeRoleName')
ticdc_service_controller_assume_role_name=$(echo ${additional_args} | jq -r '.ticdcControllerAssumeRoleName')

dataplane_accounts=$(echo ${additional_args} | jq -r '.dataplaneAccounts')
autho0_audience=$(echo ${additional_args} | jq -r '.auth0Audience')
auth0_domain=$(echo ${additional_args} | jq -r '.auth0Domain')
global_controlplane_ips=$(echo ${additional_args} | jq -r '.globalControlplaneIPs')
regional_controlplane_ips=$(echo ${additional_args} | jq -r '.regionalControlplaneIPs')
o11y_regional_service_ips=$(echo ${additional_args} | jq -r '.o11yRegionalServiceIPs')
clinic_ips=$(echo ${additional_args} | jq -r '.clinicIPs')
bastion_ips=$(echo ${additional_args} | jq -r '.bastionIPs')
authorized_subjects=$(echo ${additional_args} | jq -r '.authorizedSubjects')
public_hosted_zone_domain=$(echo ${additional_args} | jq -r '.publicHostedZoneDomain')
public_hosted_zone_id=$(echo ${additional_args} | jq -r '.publicHostedZoneID')
o11y_regional_service_endpoint=$(echo ${additional_args} | jq -r '.o11yRegionalServiceEndpoint')
o11y_seed_cluster_id=$(echo ${additional_args} | jq -r '.o11ySeedClusterId')
pca_arn=$(echo ${additional_args} | jq -r '.pcaArn')
acct2shared_buckets=$(echo ${additional_args} | jq -r '.acct2sharedBuckets')

ROOT=$(cd $(dirname ${BASH_SOURCE[0]}) && pwd)
deploy_dir="${ROOT}/envs/${cloud}-${env}-${logicalRegionName}"
variant_dir="${ROOT}/variants/${env}-${cloud}"

if [ -e ${deploy_dir} ]; then
  echo "New region deploy directory already exist"
  exit 1
fi

mkdir "${deploy_dir}"
echo "Prepare manifest files"
cp "${variant_dir}/kustomization_tmpl.yaml" "${deploy_dir}/kustomization.yaml"
cp "${variant_dir}/version_tmpl.yaml" "${deploy_dir}/version.yaml"
cp "${variant_dir}/service_account_tmpl.yaml" "${deploy_dir}/service_account.yaml"

mkdir "${deploy_dir}/config"
echo "Prepare config files"
cp "${variant_dir}/config/k8s-addon-templates.yaml" "${deploy_dir}/config/k8s-addon-templates.yaml"
cp "${variant_dir}/config/k8s-dedicated-templates_tmpl.yaml" "${deploy_dir}/config/k8s-dedicated-templates.yaml"
cp "${variant_dir}/config/k8s-dp-templates_tmpl.yaml" "${deploy_dir}/config/k8s-dp-templates.yaml"
cp "${variant_dir}/config/k8s-infra-templates_tmpl.yaml" "${deploy_dir}/config/k8s-infra-templates.yaml"
cp "${variant_dir}/config/root-config_tmpl.yaml" "${deploy_dir}/config/root-config.yaml"


find "${deploy_dir}" -type f -exec sed -i "s|TMPL_REGION|${region}|g" {} \;
sed -i "s|TMPL_IRSA_ROLE_ARN|${irsa_role_arn}|g" "${deploy_dir}/service_account.yaml"
find "${deploy_dir}" -type f -exec sed -i "s|IMAGE_REGISTRY|${image_registry}|g" {} \;
# replace the auth0 audience and domain
sed -i "s|TMPL_AUTH0_AUDIENCE|${autho0_audience}|g" "${deploy_dir}/config/k8s-dedicated-templates.yaml"
sed -i "s|TMPL_AUTH0_DOMAIN|${auth0_domain}|g" "${deploy_dir}/config/k8s-dedicated-templates.yaml"
# replace the public hosted zone domain and id
sed -i "s|TMPL_PUBLIC_HOSTED_ZONE_DOMAIN|${public_hosted_zone_domain}|g" "${deploy_dir}/config/root-config.yaml"
sed -i "s|TMPL_PUBLIC_HOSTED_ZONE_ID|${public_hosted_zone_id}|g" "${deploy_dir}/config/root-config.yaml"
# replace the o11y regional service endpoint
sed -i "s|TMPL_O11Y_REGIONAL_SERVICE_ENDPOINT|${o11y_regional_service_endpoint}|g" "${deploy_dir}/config/root-config.yaml"
# replace the o11y seed cluster id
sed -i "s|TMPL_O11Y_SEED_CLUSTER_ID|${o11y_seed_cluster_id}|g" "${deploy_dir}/config/root-config.yaml"
# replace the eks service role name
sed -i "s|TMPL_EKS_SERVICE_ROLE_NAME|${eks_service_role_name}|g" "${deploy_dir}/config/root-config.yaml"
# replace the cluster controller assume role
sed -i "s|TMPL_CLUSTER_CONTROLLER_ASSUME_ROLE_NAME|${cluster_controller_assume_role_name}|g" "${deploy_dir}/config/root-config.yaml"
sed -i "s|TMPL_READONLY_CLUSTER_CONTROLLER_ASSUME_ROLE_NAME|${readonly_cluster_controller_assume_role_name}|g" "${deploy_dir}/config/root-config.yaml"
# replace the dp controller assume role
sed -i "s|TMPL_DP_CONTROLLER_ASSUME_ROLE_NAME|${dp_controller_assume_role_name}|g" "${deploy_dir}/config/root-config.yaml"
# replace the pca arn
sed -i "s|TMPL_PCA_ARN|${pca_arn}|g" "${deploy_dir}/config/root-config.yaml"
# replace the ticdc service controller assume role
sed -i "s|TMPL_TICDC_SERVICE_CONTROLLER_ASSUME_ROLE_NAME|${ticdc_service_controller_assume_role_name}|g" "${deploy_dir}/config/root-config.yaml"

yq e -i ".regionConfig.zones |= $availability_zones" ${deploy_dir}/config/root-config.yaml

mkdir "${deploy_dir}/account"
echo "Prepare account-list.yaml"
# genrate the account list, ptah: account/account-list.yaml
account_list=${deploy_dir}/account/account-list.yaml
cat <<EOF > ${account_list}
apiVersion: v1
kind: ConfigMap
metadata:
  name: account-list
  labels:
    cloud.pingcap.com/bizType: dedicated
data:
  default: "${default_aws_acount}"
  list: |
EOF

for awsAccount in $(echo ${dataplane_accounts} | jq -r '.[]'); do
  # Extract shared buckets for this account from the mapping
  account_shared_buckets=($(echo ${acct2shared_buckets} | jq -r ".[\"${awsAccount}\"]"))

  cat <<EOF >> ${account_list}
    - awsaccountinfo:
        awsAccount: ${awsAccount}
        awsRole: ${default_aws_dp4drs_role}
        cmekEnabled: true
      sharedBucketBundle:
        defaultBucketName: ${account_shared_buckets[0]}
        buckets:
EOF
  for bucket in "${account_shared_buckets[@]}"; do
    echo "          - bucketName: ${bucket}" >> ${account_list}
  done
done


# genrate the providerconfig, path: config/providerconfig.yaml
echo "Prepare providerconfig.yaml"
providerconfig_config=${deploy_dir}/account/providerconfig.yaml
cat <<EOF > ${providerconfig_config}
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: "provider-aws-gr"
spec:
  assumeRoleARN: ${assume_role_global_arn}
  credentials:
    source: InjectedIdentity
EOF

# genrate the providerconfig
for awsAccount in $(echo ${dataplane_accounts} | jq -r '.[]'); do
  assumeRoleARN="arn:aws:iam::${awsAccount}:role/${default_aws_dp4drs_role}"
  cat <<EOF >> ${providerconfig_config}
---
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: "${awsAccount}"
spec:
  assumeRoleARN: ${assumeRoleARN}
  credentials:
    source: InjectedIdentity
EOF
done

echo "set whitelist ip"
yq e -i ".appBoxConfig.apiserverPublicAccessCidrs |= ${bastion_ips} + ${global_controlplane_ips} + ${regional_controlplane_ips} + ${o11y_regional_service_ips}" \
  ${deploy_dir}/config/root-config.yaml
yq e -i ".[0].clusterProxy.helmValues.service.loadBalancerSourceRanges |= ${global_controlplane_ips} + ${regional_controlplane_ips} + ${clinic_ips}" \
  ${deploy_dir}/config/k8s-dedicated-templates.yaml
yq e -i ".[0].clusterGateway.helmValues.proxy.loadBalancerSourceRanges |= ${global_controlplane_ips} + ${regional_controlplane_ips} + ${clinic_ips}" \
  ${deploy_dir}/config/k8s-dedicated-templates.yaml
yq e -i ".[0].dataflowAgent.helmValues.service.loadBalancerSourceRanges |= ${global_controlplane_ips} + ${regional_controlplane_ips}" \
  ${deploy_dir}/config/k8s-dp-templates.yaml

echo "set authorized subjects"
yq e -i ".appBoxConfig.authorizedSubjects |= ${authorized_subjects}" ${deploy_dir}/config/root-config.yaml