#!/usr/bin/env bash

set -x
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)

remote_config=${CONFIG_PATH}
local_config=/tmp/base-config.yaml
bucket_name=${remote_config#s3://}
bucket_name=${bucket_name%%/*}
output_bucket_region=$(aws s3api get-bucket-location --bucket=$bucket_name --query="LocationConstraint" \
  --region=us-west-2 --output=text --no-cli-pager)
aws s3 cp ${remote_config} ${local_config} --region=$output_bucket_region

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cloud_provider=$(yq '.cloudProvider' "${local_config}")
region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
cluster_name=$(yq '.k8s.name' "${local_config}")
# account_id=$(aws sts get-caller-identity --query "Account" --output text)
account_id=$(yq '.aws.controlplaneAccount' "${local_config}")
dataplane_accounts=$(yq -ojson '.aws.dataplaneAccounts' "${local_config}" | jq -r '.[]')
echo "cloud_provider: $cloud_provider"
echo "region: $region"
echo "logical_region_name: $logical_region_name"
echo "env: $env"
echo "cluster_name: $cluster_name"
echo "account_id: $account_id"
echo "dataplane_accounts: $dataplane_accounts"

# oidc_issuer_url=$(aws eks describe-cluster \
#   --name $cluster_name \
#   --query 'cluster.identity.oidc.issuer' \
#   --output text)
oidc_issuer_url=$(yq '.k8s.oidcIssuer' "${local_config}")
oidc_issuer=${oidc_issuer_url#https://}
echo "oidc_issuer_url: $oidc_issuer_url"
echo "oidc_issuer: $oidc_issuer"

# Create customer managed polocies
for policy_file in $ROOT/aws/policies/*.json; do
  policy_name=$(basename "$policy_file" .json)
  echo "Processing policy: $policy_name"

  # Check if the policy already exists
  if aws iam get-policy --policy-arn arn:aws:iam::${account_id}:policy/${policy_name} > /dev/null 2>&1; then
    echo "Policy ${policy_name} already exists. Skipping creation."
  else
    echo "Creating policy ${policy_name}..."
    aws iam create-policy \
      --policy-name ${policy_name} \
      --policy-document file://${policy_file}
  fi
done

aws cloudformation deploy \
  --region $region \
  --stack-name auto-deploy-$cluster_name-iam \
  --template-file $ROOT/aws/cloudformation/iam.yaml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameter-overrides \
    Env=$env \
    Region=$region \
    ClusterName=$cluster_name \
    AccountId=$account_id \
    OIDCIssuer=$oidc_issuer

cat <<EOF > "${local_output}"
loadBalancerController:
  roleArn: arn:aws:iam::${account_id}:role/alb-controller-${cluster_name}
externalDns:
  roleArn: arn:aws:iam::${account_id}:role/external-dns-${cluster_name}
awsClusterAutoscaler:
  roleArn: arn:aws:iam::${account_id}:role/aws-ca-${cluster_name}
regionalServer:
  roleArn: arn:aws:iam::${account_id}:role/regional-server-${cluster_name}
loki:
  roleArn: arn:aws:iam::${account_id}:role/loki-${cluster_name}
vmbackup:
  roleArn: arn:aws:iam::${account_id}:role/vmbackup-${cluster_name}
alertManager:
  roleArn: arn:aws:iam::${account_id}:role/alertmanager-${cluster_name}
o11yBackup:
  roleArn: arn:aws:iam::${account_id}:role/o11y-backup-${cluster_name}
EOF
echo "Write output to S3..."
aws s3 cp "${local_output}" "${remote_output}" --region=$output_bucket_region