#!/usr/bin/env bash

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "$ROOT/lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp "${remote_config}" "${local_config}" --region=$output_bucket_region

argocd_repo=tidbcloud/app-delivery
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cloud=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")

remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aws s3 cp ${remote_iam_config} ${local_iam_config} --region=$output_bucket_region
awsRoleArn=$(yq '.externalSecretsOperator.roleArn' "${local_iam_config}")

secretNames=($(yq '.jobOptions.secrets | .[]' "${local_config}"))
eanble_replicate_secret=$(yq '.jobOptions.externalSecretsOperator.eanbleReplicateSecret // true' "${local_config}")

if [[ "${eanble_replicate_secret}" == "true" && $region != "us-west-2" ]]; then
  for secret in "${secretNames[@]}"; do
    aws secretsmanager replicate-secret-to-regions --secret-id "${secret}" --add-replica-regions Region=${region} --region=us-west-2
  done
fi

# Deploy application services by invoking deploy-new-region action in $argocd_repo
# awsIrsaRoleArn is hardcode in workflow, don't need to pass it
common_params="-f cloud=${cloud} -f region=${region} -f env=${env} -f cluster=${cluster} -f jobId=${jobId} -f logicalRegionName=${logicalRegionName}"
export GH_REPO="${argocd_repo}"
gh workflow run deploy-new-region-next-gen-external-secrets-operator.yaml ${common_params} -f awsRoleArn="${awsRoleArn}"

# Wait services ready
declare -A services
services["deploy/external-secrets"]="false"
services["deploy/external-secrets-cert-controller"]="false"
services["deploy/external-secrets-webhook"]="false"
namespace="external-secrets"
wait_for_services_ready services namespace
if [[ $? -eq 1 ]]; then
    echo "Services are not ready"
    exit 1
fi