#!/usr/bin/env bash

set -xeuo pipefail

ROOT=$(cd $(dirname ${BASH_SOURCE[0]}) && pwd)
source ${ROOT}/lib.sh

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config}  --region=$output_bucket_region

o11y_repo=tidbcloud/observability
git_ref="main"
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")
clinic_url=$(yq '.jobOptions.o11yRegion.clinicUrl' "${local_config}")
byoc_tenant_id=$(yq '.jobOptions.o11yRegion.byocTenantID' "${local_config}")
clinic_secret_id=$(yq '.jobOptions.o11yRegion.clinicSecretID' "${local_config}")
resourceOwnerTag=$(yq '.jobOptions.resourceOwnerTag' "${local_config}")

imageRegistry=$(yq '.jobOptions.o11yRegion.imageRegistry' "${local_config}")
hosted_zone_name=$(yq '.jobOptions.o11yRegion.dns.hostedZoneName // ""' "${local_config}")
if [ -z "$hosted_zone_name" ]; then
  if [ "$env" == "prod" ]; then
      hosted_zone_name="observability.tidbcloud.com"
  else
      hosted_zone_name="observability-$env.pingcap.cloud"
  fi
fi
echo "hosted_zone_name: $hosted_zone_name"

o11y_eks_remote_output=$(yq '.jobOutput.o11y-eks' "${local_config}")
o11y_eks_local_output=/tmp/o11y-eks-output.yaml
aws s3 cp ${o11y_eks_remote_output} ${o11y_eks_local_output}  --region=$output_bucket_region
cluster=$(yq '.cluster_name' "${o11y_eks_local_output}")
clinic_private_dns=$(yq '.clinic_dns_entry' "${o11y_eks_local_output}")
account_id=$(yq -r -ojson '.aws.dataplaneAccounts.0' "${local_config}")
kubeconfig=$(yq '.kubeconfig' "${o11y_eks_local_output}")
mkdir ~/.kube
echo "$kubeconfig" > ~/.kube/config


remote_iam_config=$(yq '.jobOutput.o11y-basic-iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aws s3 cp ${remote_iam_config} ${local_iam_config}  --region=$output_bucket_region
o11yRoleARN=$(yq '.alertManager.roleArn' "${local_iam_config}")

o11yBackupBucket="o11y-${env}-${logical_region_name}-backups"
nginxReadIngressClass="nginx-read"
nginxWriteIngressClass="nginx-write"

if ! aws --profile $account_id s3api head-bucket --bucket "$o11yBackupBucket" 2>/dev/null; then
    echo "o11y bucket $o11yBackupBucket does not exist, creating..."
    aws --profile $account_id s3 mb --region $region "s3://$o11yBackupBucket"
    aws --profile $account_id s3api put-bucket-tagging --bucket "${o11yBackupBucket}" --tagging "TagSet=[{Key=tidbcloud-auto-deploy-owner,Value=${resourceOwnerTag}}]" >/dev/null
    aws --profile $account_id s3api put-bucket-policy --bucket "$o11yBackupBucket" --policy '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DenyInsecureConnections",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::'"$o11yBackupBucket"'",
            "arn:aws:s3:::'"$o11yBackupBucket"'/*"
          ],
          "Condition": {
            "Bool": {
              "aws:SecureTransport": "false"
            }
          }
        }
      ]
    }'
    echo "o11y bucket $o11yBackupBucket created"
else
    echo "o11y bucket $o11yBackupBucket already exists"
fi

# Get clinic credentials
# read client secret using aws cli from aws secret manager
secret_string=$(aws secretsmanager get-secret-value --secret-id ${clinic_secret_id} --query SecretString --region us-west-2 --output text)
clinic_user_name=$(echo ${secret_string} | jq -r .clinicUserName)
clinic_password=$(echo ${secret_string} | jq -r .clinicPassword)
basic_auth_token=$(echo -n "${clinic_user_name}:${clinic_password}" | base64)

clinic_response=$(curl -s --location "${clinic_url}/api/byoc/v1/orgs/${byoc_tenant_id}/token" \
  --header "Authorization: Basic ${basic_auth_token}" \
  --header 'Content-Type: application/json')

am_user_name=$(echo "$clinic_response" | jq -r '.username')
am_password=$(echo "$clinic_response" | jq -r '.password')

if [[ -z "$am_user_name" || -z "$am_password" ]]; then
  echo "Failed to get alertmanager credentials"
  exit 1
fi

args=$(cat <<EOF
{
  "alertmanagerRoleArn": "$o11yRoleARN",
  "o11yBackupRoleArn": "$o11yRoleARN",
  "o11yBackupBucket": "$o11yBackupBucket",
  "nginxReadIngressClass": "$nginxReadIngressClass",
  "nginxWriteIngressClass": "$nginxWriteIngressClass",
  "imageRegistry": "$imageRegistry",
  "hostedZoneName": "$hosted_zone_name",
  "clinicPrivateDNS": "$clinic_private_dns",
  "alertmanagerUserName": "$am_user_name",
  "alertmanagerPassword": "$am_password",
  "tenantID": "$byoc_tenant_id",
  "byoc": true
}
EOF
)
echo "args: $args"


common_params="-f vendor=${vendor} -f region=${region} -f logicalRegionName=${logical_region_name} -f env=${env} -f cluster=${cluster} -f jobId=${jobId}"
# Create pull request by invoking new-region workflow.
gh workflow run new-region-infra.yaml --repo ${o11y_repo} --ref ${git_ref} ${common_params} -f args="${args}"
wait_workflow_run_to_merge new-region-infra.yaml ${o11y_repo}
if [[ $? -eq 1 ]]; then
    exit 1
fi

# Deploy application services by invoking infra-cd workflow
gh workflow run infra-cd-v2.yaml --repo ${o11y_repo} --ref ${git_ref} -f env=${env} -f region=${logical_region_name} -f vendor=${vendor} -f git-ref=${git_ref} -f aws-role-arn="arn:aws:iam::${account_id}:role/auto-deploy-cli"

# Wait services ready
declare -A services

services["deploy/eventrouter -n kube-system"]="false"
services["sts/prometheus-self-monitoring-kube-prome-prometheus -n self-monitoring"]="false"
services["sts/alertmanager-self-monitoring-kube-prome-alertmanager -n self-monitoring"]="false"
services["deploy/volume-autoscaler -n self-monitoring"]="false"
services["ds/self-vector -n self-monitoring"]="false"
services["deploy/victoria-metrics-operator -n self-monitoring"]="false"

if [[ $vendor == "aws" ]]; then
  services["deploy/cert-manager -n kube-system"]="false"
fi

timeout=${JOB_TIMEOUT:=600} # 10 mins
interval=${JOB_CHECK_INTERVAL:=10}
start_time=$(date +%s)
echo "Waiting all services ready..."
set +e
while [[ $(($(date +%s) - $start_time)) -lt $timeout ]]; do
  all_ready=true
  for svc in "${!services[@]}"; do
    if [[ ${services[$svc]} == "true" ]]; then
      continue
    else
      all_ready=false
    fi

    # for self-vector daemonset, we need to check the number of available pods
    if [[ $svc == "ds/self-vector -n self-monitoring" ]]; then
      ready=$(kubectl get ${svc} -ojsonpath='{.status.numberReady}' 2>/dev/null)
    else
      ready=$(kubectl get ${svc} -ojsonpath='{.status.readyReplicas}' 2>/dev/null)
    fi

    if [[ $? -eq 0 ]]; then
      if [[ $ready -ge 1 ]]; then
        services[$svc]="true"
        echo "Service $svc is ready"
      fi
    fi
  done

  if $all_ready; then
    echo "All services ready!"
    exit 0
  else
    sleep "${interval}"
  fi
done

# Report unready services
echo "Following services are unready:"
for svc in "${!services[@]}"; do
  if [[ ${services[$svc]} == "false" ]]; then
    echo $svc
  fi
done
exit 1