#!/usr/bin/env bash
set -euo pipefail
# This script should be idempotent and retriable
# It's used to deploy a new region
# When adding a new dataplane aws account, this script should be
# invoked several times, each with a single region
action=${1:-destroy}
remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp "${remote_config}" "${local_config}" --region=$output_bucket_region

cloud=$(yq '.cloudProvider' "${local_config}")
env=$(yq '.env' "${local_config}")
globalEnv=$(yq ".globalEnv // \"$env\"" "${local_config}")
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
eks_oidc=$(yq '.k8s.oidcIssuer' "${local_config}" | sed -E 's/^\s*.*:\/\///g')
controlplane_account=$(yq '.aws.controlplaneAccount' "${local_config}")
dataplane_accounts_json=$(yq -ojson '.aws.dataplaneAccounts' "${local_config}" | jq -c '.')
dataplane_accounts=$(yq -ojson '.aws.dataplaneAccounts' "${local_config}" | jq -r '.[]')
is_byoc=$(yq '.jobOptions.isByoc // "false"' "${local_config}")
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml
ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
tf_directory="${ROOT}/../iam_tf"
tf_s3_bucket=$(yq '.terraformStateBucket' "${local_config}")
tf_s3_region=$(aws s3api get-bucket-location --bucket $tf_s3_bucket --region $region --query "LocationConstraint" --output text)
billing_sqs_arn=$(yq '.jobOptions.metering.billingSQSArn' "${local_config}")
resourceOwnerTag=$(yq '.jobOptions.resourceOwnerTag' "${local_config}")

remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aws s3 cp ${remote_iam_config} ${local_iam_config} --region=$output_bucket_region
dataplane_manager_role_arn=$(yq '.dataplane_manager.roleArn' "${local_iam_config}")
metering_read_write_role_arn=$(yq '.metering.readWriteRoleArn' "${local_iam_config}")

# Provision dataplane-manager iam role in controlplane account
module_path="dataplane-manager/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
dataplane_manager_assumed_role_name=$(yq '.jobOptions.dataplaneManager.dataplaneAssumedRole // "tidbcloud-dataplane-manager-assumed-role"' "${local_config}")
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="dataplane_accounts=${dataplane_accounts_json}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="is_byoc=${is_byoc}" \
  -var="dataplane_role_name=${dataplane_manager_assumed_role_name}" \
  -var="metering_read_write_role_arn=${metering_read_write_role_arn}" \
  -var="billing_sqs_arn=${billing_sqs_arn}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision cert-manager iam role in controlplane account
module_path="cert-manager/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision external-secrets-operator iam role in controlplane account
module_path="external-secrets-operator/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" -var="secret_prefix=${globalEnv}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision aws-lb-controller iam role in controlplane account
module_path="aws-load-balancer-controller/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

# Provision cluster autoscaler iam role in controlplane account
module_path="cluster-autoscaler/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

assume_o11y_role_arn=$(yq -ojson '.jobOptions.vector.o11yRoleArn' "${local_config}" | jq -r '.[]')
module_path="vector-agent/controlplane"
cd "${tf_directory}/${module_path}"
tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
terraform destroy -auto-approve -var="env=${env}" \
  -var="logical_region_name=${logicalRegionName}" \
  -var="controlplane_account=${controlplane_account}" \
  -var="assume_o11y_role_arn=${assume_o11y_role_arn}" \
  -var="eks_oidc=${eks_oidc}" \
  -var="auto_deploy_owner_tag=${resourceOwnerTag}"

is_byoc=$(yq '.jobOptions.isByoc // "false"' "${local_config}")
if $is_byoc; then
  byoc_dataplane_account=$(yq '.aws.dataplaneAccounts.0' "${local_config}")
  module_path="metering/byoc"
  cd "${tf_directory}/${module_path}"
  tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
  terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
  terraform destroy -auto-approve -var="env=${env}" \
    -var="byoc_account=${byoc_dataplane_account}" \
    -var="logical_region_name=${logicalRegionName}" \
    -var="auto_deploy_owner_tag=${resourceOwnerTag}"
else
  module_path="metering/premium"
  cd "${tf_directory}/${module_path}"
  tf_state="${module_path}/${controlplane_account}-${env}-${logicalRegionName}-tfstate.json"
  terraform init -backend-config="bucket=${tf_s3_bucket}" -backend-config="key=${tf_state}" -backend-config="region=${tf_s3_region}"
  terraform destroy -auto-approve -var="env=${env}" \
    -var="region=${region}" \
    -var="logical_region_name=${logicalRegionName}" \
    -var="dataplane_manager_role_arn=${dataplane_manager_role_arn}" \
    -var="dataplane_accounts=${dataplane_accounts_json}" \
    -var="dataplane_manager_assumed_role_name=${dataplane_manager_assumed_role_name}" \
    -var="billing_sqs_arn=${billing_sqs_arn}" \
    -var="auto_deploy_owner_tag=${resourceOwnerTag}"
fi