#!/usr/bin/env bash
set -xeuo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "$ROOT/lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
download_blob "${remote_config}" "${local_config}"

remote_iam_config=$(yq '.jobOutput.iam' "${local_config}")
local_iam_config=/tmp/iam-config.yaml
download_blob "${remote_iam_config}" "${local_iam_config}"

remote_regional_resource=$(yq '.jobOutput.regional-resource' "${local_config}")
local_regional_resource=/tmp/regional-resource.yaml
download_blob "${remote_regional_resource}" "${local_regional_resource}"

argocd_repo=tidbcloud/app-delivery
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cloud=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
job_id=$(yq '.jobId' "${local_config}")
output=$(yq '.outputPath' "${local_config}")

# Deploy application services by invoking deploy-new-region action in $argocd_repo
# awsIrsaRoleArn is hardcode in workflow, don't need to pass it
common_params="-f cloud=${cloud} -f region=${region} -f env=${env} -f cluster=${cluster} -f jobId=${job_id} -f logicalRegionName=${logical_region_name}"

# new fields for azure
# external-secrets-operator managed identity client id
external_secrets_operator_client_id=$(yq '.externalSecretsOperator.clientId' "${local_iam_config}")
# secretstore vault url
secretstore_vault_url=$(yq '.keyVault.uri' "${local_regional_resource}")
# azure tenant id
azure_tenant_id=$(yq '.azure.controlplaneTenantId' "${local_config}")

additional_args=$(cat <<EOF
{
  "externalSecretsOperatorClientID": "${external_secrets_operator_client_id}",
  "secretstoreVaultURL": "${secretstore_vault_url}",
  "azureTenantID": "${azure_tenant_id}"
}
EOF
)

echo "additional_args: ${additional_args}"

export GH_REPO="${argocd_repo}"
gh workflow run deploy-new-region-external-secrets-operator-azure.yaml ${common_params} -f additionalArgs="${additional_args}"

# Wait services ready
declare -A services
services["deploy/regional-external-secrets-operator"]="false"
services["deploy/regional-external-secrets-operator-cert-controller"]="false"
services["deploy/regional-external-secrets-operator-webhook"]="false"
namespace="external-secrets"
wait_for_services_ready services namespace