#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "${ROOT}/lib.sh"

# load config
remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
aks_oidc_issuer=$(yq '.k8s.oidcIssuer' "${local_config}")
dataplane_subscriptions=$(yq -ojson '.azure.dataplaneSubscriptions' "${local_config}" | jq -r '.[]')
job_id=$(yq '.jobId' "${local_config}")
remote_output=$(yq '.outputPath' "${local_config}")
local_output=/tmp/output.yaml

# load terraform config
controlplane_tenant=$(yq '.azure.controlplaneTenantId' "${local_config}")
controlplane_subscription=$(yq '.azure.controlplaneSubscriptionId' "${local_config}")
client_id=$(yq '.azure.controlplaneClientId' "${local_config}")
tf_blob_endpoint=$(yq '.terraformStateBucket' "${local_config}")
tfstate_storage_account=$(get_blob_storage_account "${tf_blob_endpoint}")
tfstate_container=$(get_blob_container "${tf_blob_endpoint}")
tfstate_rg=$(az storage account show --name ${tfstate_storage_account} --query "resourceGroup" --output tsv)
access_key=$(az storage account keys list --account-name ${tfstate_storage_account} --resource-group ${tfstate_rg} --query "[0].value" --output tsv)
tf_common_backend_config="-backend-config=resource_group_name=${tfstate_rg} -backend-config=storage_account_name=${tfstate_storage_account} -backend-config=container_name=${tfstate_container}"

# set terraform environments
export ARM_USE_OIDC=true
export ARM_CLIENT_ID="${client_id}"
export ARM_TENANT_ID="${controlplane_tenant}"
export ARM_ACCESS_KEY="${access_key}"

tf_directory="${ROOT}/terraform"
module_path="crossplane-azure-provider/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
crossplane_principal_id=$(terraform output -json | jq -r '.principal_id.value')
crossplane_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="crossplane-azure-provider/dataplane"
cd "${tf_directory}/${module_path}"
for sub in ${dataplane_subscriptions[@]}; do
  tfstate="${module_path}/${sub}-${logical_region_name}-tfstate.json"
  export ARM_SUBSCRIPTION_ID="${sub}"
  terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
  terraform apply -auto-approve -var="principal_id=${crossplane_principal_id}"
done

module_path="external-secrets-operator/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
external_secrets_operator_principal_id=$(terraform output -json | jq -r '.principal_id.value')
external_secrets_operator_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="cert-manager/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
cert_manager_principal_id=$(terraform output -json | jq -r '.principal_id.value')
cert_manager_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="regional-server/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
region_server_principal_id=$(terraform output -json | jq -r '.principal_id.value')
region_server_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="regional-server/dataplane"
cd "${tf_directory}/${module_path}"
for sub in ${dataplane_subscriptions[@]}; do
  tfstate="${module_path}/${sub}-${logical_region_name}-tfstate.json"
  export ARM_SUBSCRIPTION_ID="${sub}"
  terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
  terraform apply -auto-approve -var="principal_id=${region_server_principal_id}"
done

module_path="tcidm/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
dm_principal_id=$(terraform output -json | jq -r '.dm_principal_id.value')
dm_client_id=$(terraform output -json | jq -r '.dm_client_id.value')
import_principal_id=$(terraform output -json | jq -r '.import_principal_id.value')
import_client_id=$(terraform output -json | jq -r '.import_client_id.value')

module_path="cluster-controller/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
cluster_controller_principal_id=$(terraform output -json | jq -r '.principal_id.value')
cluster_controller_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="cluster-controller/dataplane"
cd "${tf_directory}/${module_path}"
for sub in ${dataplane_subscriptions[@]}; do
  tfstate="${module_path}/${sub}-${logical_region_name}-tfstate.json"
  export ARM_SUBSCRIPTION_ID="${sub}"
  terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
  terraform apply -auto-approve -var="principal_id=${cluster_controller_principal_id}"
done

module_path="ticdc-service/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
ticdc_service_principal_id=$(terraform output -json | jq -r '.principal_id.value')
ticdc_service_client_id=$(terraform output -json | jq -r '.client_id.value')

module_path="ticdc-service/dataplane"
cd "${tf_directory}/${module_path}"
for sub in ${dataplane_subscriptions[@]}; do
  tfstate="${module_path}/${sub}-${logical_region_name}-tfstate.json"
  export ARM_SUBSCRIPTION_ID="${sub}"
  terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
  terraform apply -auto-approve -var="principal_id=${ticdc_service_principal_id}"
done

module_path="vector-agent/controlplane"
cd "${tf_directory}/${module_path}"
tfstate="${module_path}/${controlplane_subscription}-${logical_region_name}-tfstate.json"
export ARM_SUBSCRIPTION_ID="${controlplane_subscription}"
terraform init -reconfigure ${tf_common_backend_config} -backend-config="key=${tfstate}"
terraform apply -auto-approve -var="env=${env}" \
  -var="location=${region}" \
  -var="aks_oidc_issuer=${aks_oidc_issuer}" \
  -var="logical_region_name=${logical_region_name}"
vector_agent_principal_id=$(terraform output -json | jq -r '.principal_id.value')
vector_agent_client_id=$(terraform output -json | jq -r '.client_id.value')


cat <<EOF > "${local_output}"
clusterController:
  clientId: ${cluster_controller_client_id}
  principalId: ${cluster_controller_principal_id}
ticdcService:
  clientId: ${ticdc_service_client_id}
  principalId: ${ticdc_service_principal_id}
regionServer:
  clientId: ${region_server_client_id}
  principalId: ${region_server_principal_id}
tcidm:
  dmClientId: ${dm_client_id}
  dmPrincipalId: ${dm_principal_id}
  importClientId: ${import_client_id}
  importPrincipalId: ${import_principal_id}
crossplaneAzureProvider:
  clientId: ${crossplane_client_id}
  principalId: ${crossplane_principal_id}
externalSecretsOperator:
  clientId: ${external_secrets_operator_client_id}
  principalId: ${external_secrets_operator_principal_id}
certManager:
  clientId: ${cert_manager_client_id}
  principalId: ${cert_manager_principal_id}
vectorAgent:
  clientId: ${vector_agent_client_id}
  principalId: ${vector_agent_principal_id}
EOF

upload_blob "${local_output}" "${remote_output}" --overwrite