#!/usr/bin/env bash

set -x
set -euo pipefail

ROOT=$(cd $(dirname ${BASH_SOURCE[0]}) && pwd)
source ${ROOT}/../lib.sh

remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
cluster_name=$(yq '.k8s.name' "${local_config}")
jobId=$(yq '.jobId' "${local_config}")

# login to AWS
export AWS_REGION=us-west-2
id_token=$(curl -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}" | jq -r '.value')
role=$(yq '.jobOptions.awsAccountRole' "${local_config}")
sns_topic_arn=$(yq '.jobOptions.awsSNSARN' "${local_config}")
resp=$(aws sts assume-role-with-web-identity --web-identity-token "${id_token}" \
  --role-arn "${role}" \
  --role-session-name "azure-iam-${env}-${logical_region_name}")
export AWS_ACCESS_KEY_ID=$(echo $resp | jq -r '.Credentials.AccessKeyId')
export AWS_SECRET_ACCESS_KEY=$(echo $resp | jq -r '.Credentials.SecretAccessKey')
export AWS_SESSION_TOKEN=$(echo $resp | jq -r '.Credentials.SessionToken')
aws_account_id=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager)
echo "Login to AWS with account ${aws_account_id}"

# Get OIDC issuer URL from config
aks_oidc_issuer_url=$(yq '.k8s.oidcIssuer' "${local_config}")
aks_oidc_issuer=${aks_oidc_issuer_url#https://}
oidc_audience="observability.pingcap.com"

# 1. Create OIDC provider
oidc_provider_arn="arn:aws:iam::${aws_account_id}:oidc-provider/${aks_oidc_issuer}"
if ! aws iam get-open-id-connect-provider --open-id-connect-provider-arn "$oidc_provider_arn" &> /dev/null; then
  aws iam create-open-id-connect-provider \
    --url "$aks_oidc_issuer_url" \
    --client-id-list "$oidc_audience" \
    --thumbprint-list "df3c24f9bfd666761b268073fe06d1cc8d4f82a4"
fi

# 2. Create IAM role
dms_role_name="${cluster_name}-dms"
trust_policy=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "${oidc_provider_arn}"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "${aks_oidc_issuer}:sub": "system:serviceaccount:self-monitoring:self-monitoring-kube-prome-alertmanager",
          "${aks_oidc_issuer}:aud": "${oidc_audience}"
        }
      }
    }
  ]
}
EOF
)

# Create role if not exists
if ! aws iam get-role --role-name "$dms_role_name" > /dev/null; then
    aws iam create-role \
        --role-name "$dms_role_name" \
        --assume-role-policy-document "$trust_policy"
fi

# Attach policy (remains the same)
aws iam attach-role-policy \
    --role-name "$dms_role_name" \
    --policy-arn "arn:aws:iam::aws:policy/CloudWatchFullAccess"

# 3. Create CloudWatch Alarms
aws cloudwatch put-metric-alarm \
    --alarm-name "WatchdogDown-${cluster_name}" \
    --alarm-description "Alarm for ${cluster_name}, triggered if deadmanswatch is down" \
    --namespace "DeadMansWatch" \
    --metric-name "Watchdog" \
    --comparison-operator "LessThanThreshold" \
    --alarm-actions "${sns_topic_arn}" \
    --threshold 1 \
    --evaluation-periods 5 \
    --period 60 \
    --statistic "Maximum" \
    --treat-missing-data "breaching" \
    --dimensions "Name=source,Value=${cluster_name}" "Name=environment,Value=${env}" "Name=scope,Value=self-monitoring"

aws cloudwatch put-metric-alarm \
    --alarm-name "AlertmanagerClusterFailedToSendAlerts-${cluster_name}" \
    --alarm-description "Alarm for ${cluster_name}, triggered if alertmanager cluster failed to send alerts to jiralert" \
    --namespace "DeadMansWatch" \
    --metric-name "AlertmanagerClusterFailedToSendAlerts" \
    --comparison-operator "GreaterThanOrEqualToThreshold" \
    --alarm-actions "${sns_topic_arn}" \
    --threshold 1 \
    --evaluation-periods 1 \
    --period 120 \
    --statistic "SampleCount" \
    --treat-missing-data "notBreaching" \
    --dimensions "Name=source,Value=${cluster_name}" "Name=environment,Value=${env}" "Name=scope,Value=self-monitoring"

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cat <<EOF > "${local_output}"
dmsRoleArn: "arn:aws:iam::${aws_account_id}:role/${dms_role_name}"
cloudwatchAlarmName: "WatchdogDown-${cluster_name}"
oidcProviderArn: "${oidc_provider_arn}"
EOF
upload_blob "${local_output}" "${remote_output}" --overwrite