#!/usr/bin/env bash
set -x

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml

bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp "${remote_config}" "${local_config}" --region=$output_bucket_region

argocd_repo=tidbcloud/app-delivery
region=$(yq '.region' "${local_config}")
logicalRegionName=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cloud=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")

remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
aws s3 cp ${remote_iam_config} ${local_iam_config} --region=$output_bucket_region
awsRoleArn=$(yq '.externalSecretsOperator.roleArn' "${local_iam_config}")
defaultSecretNames=(
    "${env}-dedicated-infra-kubeconfig"
    "${env}-dp-compat-xregion-auth-key"
    "${env}-proxy-auth0-client"
    "${env}-o11y-auth0-client"
    "${env}-config-manager-account-xregion-auth-key"
    "${env}-config-manager-clinic-activity-key"
)

secretNames=($(yq '.jobOptions.externalSecretsOperator.secretNames // [] | .[]' "${local_config}"))
eanble_replicate_secret=$(yq '.jobOptions.externalSecretsOperator.eanbleReplicateSecret // true' "${local_config}")

if [[ "${eanble_replicate_secret}" == "true" && $region != "us-west-2" ]]; then
  if [[ ${#secretNames[@]} -eq 0 ]]; then
    secretNames=("${defaultSecretNames[@]}")
  fi
  for secret in "${secretNames[@]}"; do
    aws secretsmanager replicate-secret-to-regions --secret-id "${secret}" --add-replica-regions Region=${region} --region=us-west-2
  done
fi

# Deploy application services by invoking deploy-new-region action in $argocd_repo
# awsIrsaRoleArn is hardcode in workflow, don't need to pass it
common_params="-f cloud=${cloud} -f region=${region} -f env=${env} -f cluster=${cluster} -f jobId=${jobId} -f logicalRegionName=${logicalRegionName}"
export GH_REPO="${argocd_repo}"
gh workflow run deploy-new-region-external-secrets-operator.yaml ${common_params} -f awsRoleArn="${awsRoleArn}"

# Wait services ready
declare -A services
services["external-secrets"]="false"
services["external-secrets-cert-controller"]="false"
services["external-secrets-webhook"]="false"
ns="external-secrets"
timeout=${JOB_TIMEOUT:=300} # 5min
interval=${JOB_CHECK_INTERVAL:=10}
start_time=$(date +%s)
echo "Waiting all services ready..."
while [[ $(($(date +%s) - $start_time)) -lt $timeout ]]; do
  all_ready=true
  for svc in "${!services[@]}"; do
    if [[ ${services[$svc]} == "true" ]]; then
      continue
    else
      all_ready=false
    fi
    ready=$(kubectl -n "${ns}" get deploy "${svc}" -ojsonpath='{.status.readyReplicas}' 2>/dev/null)
    if [[ $? -eq 0 ]]; then
      if [[ $ready -ge 1 ]]; then
        services[$svc]="true"
        echo "Service $svc is ready"
      fi
    fi
  done

  if $all_ready; then
    echo "All services ready!"
    exit 0
  else
    sleep "${interval}"
  fi
done
# Report unready services
echo "Following services are unready:"
for svc in "${!services[@]}"; do
  if [[ ${services[$svc]} == "false" ]]; then
    echo $svc
  fi
done
exit 1