#!/usr/bin/env bash

set -x
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source "$ROOT/../lib.sh"

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config} --region=$output_bucket_region

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cloud_provider=$(yq '.cloudProvider' "${local_config}")
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
account_id=$(yq '.aws.controlplaneAccount' "${local_config}")
sns_topic_arn=$(yq '.jobOptions.dms.snsTopicArn' "${local_config}")
cluster_name=$(yq '.k8s.name' "${local_config}")
oidc_issuer_url=$(yq '.k8s.oidcIssuer' "${local_config}")
oidc_issuer=${oidc_issuer_url#https://}
oidc_provider_arn=arn:aws:iam::${account_id}:oidc-provider/${oidc_issuer}
oidc_audience="sts.amazonaws.com"

echo "oidc_issuer_url: $oidc_issuer_url"
echo "oidc_issuer: $oidc_issuer"
echo "cloud_provider: $cloud_provider"
echo "region: $region"
echo "logical_region_name: $logical_region_name"
echo "env: $env"
echo "account_id: $account_id"
echo "sns_topic_arn: $sns_topic_arn"
echo "cluster_name: $cluster_name"


# 1. Create IAM role
dms_role_name="${cluster_name}-dms"
trust_policy=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "${oidc_provider_arn}"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "${oidc_issuer}:sub": "system:serviceaccount:self-monitoring:self-monitoring-kube-prome-alertmanager",
          "${oidc_issuer}:aud": "${oidc_audience}"
        }
      }
    }
  ]
}
EOF
)

# Create role if not exists
if ! aws iam get-role --role-name "$dms_role_name" > /dev/null; then
    aws iam create-role \
        --role-name "$dms_role_name" \
        --assume-role-policy-document "$trust_policy"
fi

# Attach policy
aws iam attach-role-policy \
    --role-name "$dms_role_name" \
    --policy-arn "arn:aws:iam::aws:policy/CloudWatchFullAccess"

# 2. Create CloudWatch Alarms
aws cloudwatch put-metric-alarm \
    --region us-west-2 \
    --alarm-name "WatchdogDown-${cluster_name}" \
    --alarm-description "Alarm for ${cluster_name}, triggered if deadmanswatch is down" \
    --namespace "DeadMansWatch" \
    --metric-name "Watchdog" \
    --comparison-operator "LessThanThreshold" \
    --alarm-actions "${sns_topic_arn}" \
    --threshold 1 \
    --evaluation-periods 5 \
    --period 60 \
    --statistic "Maximum" \
    --treat-missing-data "breaching" \
    --dimensions "Name=source,Value=${cluster_name}" "Name=environment,Value=${env}" "Name=scope,Value=self-monitoring"

aws cloudwatch put-metric-alarm \
    --region us-west-2 \
    --alarm-name "AlertmanagerClusterFailedToSendAlerts-${cluster_name}" \
    --alarm-description "Alarm for ${cluster_name}, triggered if alertmanager cluster failed to send alerts to jiralert" \
    --namespace "DeadMansWatch" \
    --metric-name "AlertmanagerClusterFailedToSendAlerts" \
    --comparison-operator "GreaterThanOrEqualToThreshold" \
    --alarm-actions "${sns_topic_arn}" \
    --threshold 1 \
    --evaluation-periods 1 \
    --period 120 \
    --statistic "SampleCount" \
    --treat-missing-data "notBreaching" \
    --dimensions "Name=source,Value=${cluster_name}" "Name=environment,Value=${env}" "Name=scope,Value=self-monitoring"

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cat <<EOF > "${local_output}"
dmsRoleArn: "arn:aws:iam::${account_id}:role/${dms_role_name}"
cloudwatchAlarmName: "WatchdogDown-${cluster_name}"
EOF
echo "Write output to S3..."
aws s3 cp "${local_output}" "${remote_output}" --region=$output_bucket_region