#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/../lib.sh"

# load config
remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
aks_oidc_issuer=$(yq '.k8s.oidcIssuer' "${local_config}" | sed 's|^[a-zA-Z]*://||') # 去掉schema前缀
dataplane_subscriptions=$(yq -ojson '.azure.dataplaneSubscriptions' "${local_config}" | jq -r '.[]')
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml

remote_iam_config=$(yq '.jobOutput.aws-iam' "${local_config}")
local_iam_config=/tmp/aws-iam-config.yaml
download_blob "${remote_iam_config}" "${local_iam_config}"
crossplane_role_arn=$(yq '.crossplaneAwsProvider.roleArn' "${local_iam_config}")

# login to AWS
export AWS_REGION=us-west-2
id_token=$(curl -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}" | jq -r '.value')
role=$(yq '.jobOptions.awsAccountRole' "${local_config}")
resp=$(aws sts assume-role-with-web-identity --web-identity-token "${id_token}" \
  --role-arn "${role}" \
  --role-session-name "azure-iam-${env}-${logical_region_name}")
export AWS_ACCESS_KEY_ID=$(echo $resp | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $resp | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $resp | jq -r '.Credentials.SessionToken')
aws_account_id=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager)

# load terraform config
controlplane_tenant=$(yq '.azure.controlplaneTenantId' "${local_config}")
controlplane_subscription=$(yq '.azure.controlplaneSubscriptionId' "${local_config}")
client_id=$(yq '.azure.controlplaneClientId' "${local_config}")
tf_blob_endpoint=$(yq '.terraformStateBucket' "${local_config}")
tfstate_storage_account=$(get_blob_storage_account "${tf_blob_endpoint}")
tfstate_container=$(get_blob_container "${tf_blob_endpoint}")
tfstate_rg=$(az storage account show --name ${tfstate_storage_account} --query "resourceGroup" --output tsv)
access_key=$(az storage account keys list --account-name ${tfstate_storage_account} --resource-group ${tfstate_rg} --query "[0].value" --output tsv)
tf_common_backend_config="-backend-config=resource_group_name=${tfstate_rg} -backend-config=storage_account_name=${tfstate_storage_account} -backend-config=container_name=${tfstate_container}"

# set terraform environments
export ARM_USE_OIDC=true
export ARM_CLIENT_ID="${client_id}"
export ARM_TENANT_ID="${controlplane_tenant}"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
export ARM_ACCESS_KEY="${access_key}"

tf_directory="${ROOT}/../aws-terraform"
module_path="oidc-provider"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform destroy -auto-approve -var="aks_oidc=${aks_oidc_issuer}"

module_path="region-server/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform destroy -auto-approve -var="aks_oidc=${aks_oidc_issuer}" \
  -var="env=${env}" \
  -var="logical_region_name=${logical_region_name}" \
  -var="controlplane_account=${aws_account_id}" \
  -var="crossplane_role_arn=${crossplane_role_arn}"

module_path="crossplane-aws-provider/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="aks_oidc=${aks_oidc_issuer}" \
  -var="env=${env}" \
  -var="logical_region_name=${logical_region_name}" \
  -var="controlplane_account=${aws_account_id}"