#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/../lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

output_bucket_endpoint=$(get_oss_bucket_endpoint "$remote_config")
aliyun oss cp "${remote_config}" "${local_config}" --endpoint=$output_bucket_endpoint -f

action="destroy -auto-approve"

cloud=$(yq '.cloudProvider' "${local_config}")
env=$(yq '.env' "${local_config}")
globalEnv=$(yq ".globalEnv // \"$env\"" "${local_config}")
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
controlplane_account=$(yq '.alicloud.controlplaneAccount' "${local_config}")
dataplane_accounts_json=$(yq -ojson '.alicloud.dataplaneAccounts' "${local_config}" | jq -c '.')
dataplane_accounts=$(yq -ojson '.alicloud.dataplaneAccounts' "${local_config}" | jq -r '.[]')
is_byoc=$(yq '.jobOptions.isByoc // "false"' "${local_config}")
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml
resourceOwnerTag=$(yq '.jobOptions.resourceOwnerTag' "${local_config}")

oidc_issuer=$(yq '.k8s.oidcIssuer' "${local_config}")
oidc_arn=$(get_oidc_arn "$cluster")

remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aliyun oss cp ${remote_iam_config} ${local_iam_config} --endpoint=$output_bucket_endpoint -f
dataplane_manager_role_arn=$(yq '.dataplane_manager.roleArn' "${local_iam_config}")

tf_directory="${ROOT}/../iam_tf"
tf_oss_bucket=$(yq '.terraformStateBucket' "${local_config}")
tf_oss_region=$(get_oss_bucket_region "oss://${tf_oss_bucket}")

tf_common_config="-backend-config=bucket=${tf_oss_bucket} -backend-config=region=${tf_oss_region}"

# Provision cert-manager iam role in controlplane account
module_path="cert-manager/controlplane"
cd "${tf_directory}/${module_path}"
tf_state_key="${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init $tf_common_config -backend-config="prefix=${module_path}" -backend-config="key=${tf_state_key}"
terraform ${action} -var="env=${env}" \
  -var="oidc_issuer=${oidc_issuer}" \
  -var="oidc_arn=${oidc_arn}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision external-secrets-operator iam role in controlplane account
module_path="external-secrets-operator/controlplane"
cd "${tf_directory}/${module_path}"
tf_state_key="${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init $tf_common_config -backend-config="prefix=${module_path}" -backend-config="key=${tf_state_key}"
terraform ${action} -var="env=${env}"\
  -var="oidc_issuer=${oidc_issuer}" \
  -var="oidc_arn=${oidc_arn}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision dataplane-manager iam role in controlplane account
module_path="dataplane-manager/controlplane"
cd "${tf_directory}/${module_path}"
tf_state_key="${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init $tf_common_config -backend-config="prefix=${module_path}" -backend-config="key=${tf_state_key}"
terraform ${action} -var="env=${env}"\
  -var="oidc_issuer=${oidc_issuer}" \
  -var="oidc_arn=${oidc_arn}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision dataplane-manager-assumed role in dataplane accounts
module_path="dataplane-manager/dataplane"
cd "${tf_directory}/${module_path}"
dataplane_manager_controlplane_role_arns="[${dataplane_manager_role_arn}]"
for acct in ${dataplane_accounts[@]}; do
  tf_state_key="${acct}-${env}-${logicalRegionName}-tfstate.json"
  terraform init $tf_common_config -backend-config="prefix=${module_path}" -backend-config="key=${tf_state_key}"
  terraform ${action} -var="env=${env}" -var="account=${acct}" \
    -var="controlplane_role_arns=${dataplane_manager_controlplane_role_arns}" \
    -var="logical_region_name=${logicalRegionName}" \
    -var="auto_deploy_owner_tag=${resourceOwnerTag}"
done