#!/usr/bin/env bash

set -x
set -euo pipefail

ROOT=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
source ${ROOT}/../lib.sh

remote_config=${CONFIG_PATH}
local_config=/tmp/config.yaml
download_blob "${remote_config}" "${local_config}"

region=$(yq '.region' "${local_config}")
logical_region_name=$(yq '.name' "${local_config}")
env=$(yq '.env' "${local_config}")
vendor=$(yq '.cloudProvider' "${local_config}")
cluster=$(yq '.k8s.name' "${local_config}")
subscription_id=$(yq '.azure.controlplaneSubscriptionId' "${local_config}")
oidc_issuer=$(yq '.k8s.oidcIssuer' "${local_config}" )
image_registry=$(yq '.imageRegistry' "${local_config}")
job_id=$(yq '.jobId' "${local_config}")

remote_blob_config=$(yq '.jobOutput.basic-blobstorage' "${local_config}")
local_blob_config=/tmp/blob-config.yaml
download_blob ${remote_blob_config} ${local_blob_config}

storage_account_name=$(yq '.blobstorage.accountName' "${local_blob_config}")
vmbackup_blob_container=$(yq '.blobstorage.container.vmbackup' "${local_blob_config}")
loki_blob_container=$(yq '.blobstorage.container.loki' "${local_blob_config}")
storageResourceGroup=$(yq '.blobstorage.resourceGroup' "${local_blob_config}")

# IAM list
resource_group="$cluster-infra"
aks_resource_group="$cluster"
vnet_name="${cluster}-vnet"
regional_server_identity="regional-server-$cluster"
agent_controller_identity="agent-controller-$cluster"
vmbackup_identity="vmbackup-$cluster"
loki_identity="loki-$cluster"
velero_identity="velero-$cluster"

deploy_tenant_id=$(yq '.azure.controlplaneTenantId' "${local_config}")
deploy_client_id=$(yq '.azure.controlplaneClientId' "${local_config}")
azureLogin $deploy_tenant_id $deploy_client_id

echo "start creating identities"
az identity create --resource-group $resource_group --name "$agent_controller_identity"
az identity create --resource-group $resource_group --name "$regional_server_identity"
az identity create --resource-group $resource_group --name "$vmbackup_identity"
az identity create --resource-group $resource_group --name "$loki_identity"
az identity create --resource-group $resource_group --name "$velero_identity"

agent_controller_identity_client_id=$(az identity show --resource-group "$resource_group" \
  --name "${agent_controller_identity}" --query "clientId" --output tsv)
regional_server_identity_client_id=$(az identity show --resource-group "$resource_group" \
  --name "${regional_server_identity}" --query "clientId" --output tsv)
vmbackup_identity_client_id=$(az identity show --resource-group "$resource_group" \
  --name "${vmbackup_identity}" --query "clientId" --output tsv)
loki_identity_client_id=$(az identity show --resource-group "$resource_group" \
  --name "${loki_identity}" --query "clientId" --output tsv)
velero_identity_client_id=$(az identity show --resource-group "$resource_group" \
  --name "${velero_identity}" --query "clientId" --output tsv)

agent_controller_identity_principal_id=$(az identity show --resource-group "$resource_group" \
  --name "${agent_controller_identity}" --query "principalId" --output tsv)
regional_server_identity_principal_id=$(az identity show --resource-group "$resource_group" \
  --name "${regional_server_identity}" --query "principalId" --output tsv)
vmbackup_identity_principal_id=$(az identity show --resource-group "$resource_group" \
  --name "${vmbackup_identity}" --query "principalId" --output tsv)
loki_identity_principal_id=$(az identity show --resource-group "$resource_group" \
  --name "${loki_identity}" --query "principalId" --output tsv)
velero_identity_principal_id=$(az identity show --resource-group "$resource_group" \
  --name "${velero_identity}" --query "principalId" --output tsv)

echo "start creating federated identities"
az identity federated-credential create --name ${regional_server_identity} \
  --identity-name ${regional_server_identity} --resource-group ${resource_group} \
  --issuer "$oidc_issuer" --subject "system:serviceaccount:observability:regional-server-controller-manager"

az identity federated-credential create --name ${agent_controller_identity} \
  --identity-name ${agent_controller_identity} --resource-group ${resource_group} \
  --issuer "$oidc_issuer" --subject "system:serviceaccount:observability:o11y-agent-control-server"

az identity federated-credential create --name ${vmbackup_identity} \
  --identity-name ${vmbackup_identity} --resource-group ${resource_group} \
  --issuer "$oidc_issuer" --subject "system:serviceaccount:observability:vmcluster-vmcluster"

az identity federated-credential create --name ${loki_identity} \
  --identity-name ${loki_identity} --resource-group ${resource_group} \
  --issuer "$oidc_issuer" --subject "system:serviceaccount:observability:loki-ha"

az identity federated-credential create --name ${velero_identity} \
  --identity-name ${velero_identity} --resource-group ${resource_group} \
  --issuer "$oidc_issuer" --subject "system:serviceaccount:cluster-backup:velero-server"

#regional-server role assignment
echo "start creating regional-server role assignment"

az role assignment create --role "Owner" \
  --assignee-object-id "${regional_server_identity_principal_id}" --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${resource_group}"
az role assignment create --role "Owner" \
  --assignee-object-id "${regional_server_identity_principal_id}" --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${storageResourceGroup}/providers/Microsoft.Storage/storageAccounts/${storage_account_name}"
az role assignment create --role "Storage Blob Data Owner" \
  --assignee-object-id "${regional_server_identity_principal_id}" --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${storageResourceGroup}/providers/Microsoft.Storage/storageAccounts/${storage_account_name}"
az role assignment create --role "Network Contributor" \
  --assignee-object-id "${regional_server_identity_principal_id}" --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${aks_resource_group}/providers/Microsoft.Network/virtualNetworks/${vnet_name}"

#vmbackup role assignment
echo "start creating vmbackup role assignment"
az role assignment create --role "Storage Blob Data Contributor" \
  --assignee-object-id "${vmbackup_identity_principal_id}" --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${storageResourceGroup}/providers/Microsoft.Storage/storageAccounts/${storage_account_name}/blobServices/default/containers/$vmbackup_blob_container"

#loki role assignment
echo "start creating loki role assignment"
az role assignment create --role "Storage Blob Data Contributor" \
  --assignee-object-id ${loki_identity_principal_id} --assignee-principal-type ServicePrincipal \
  --scope "/subscriptions/${subscription_id}/resourceGroups/${storageResourceGroup}/providers/Microsoft.Storage/storageAccounts/${storage_account_name}/blobServices/default/containers/$loki_blob_container"

echo "start creating velero role assignment"
az role assignment create --role "Contributor" --assignee-principal-type ServicePrincipal \
  --assignee-object-id ${velero_identity_principal_id} \
  --scope "/subscriptions/${subscription_id}"

# --- register o11y into dataplane subscription admin group ---
aad_groups=($(yq '.jobOptions.iam.aadGroups[]' "${local_config}"))
for group in "${aad_groups[@]}"; do
  addAADGroupMember "${group}" "${regional_server_identity_principal_id}"
  addAADGroupMember "${group}" "${agent_controller_identity_principal_id}"
done

local_output=/tmp/output.yaml
remote_output=$(yq '.outputPath' "${local_config}")
cat <<EOF > "${local_output}"
iam:
  agentController:
    clientId: $agent_controller_identity_client_id
    principalId: $agent_controller_identity_principal_id
  regionalServer:
    clientId: $regional_server_identity_client_id
    principalId: $regional_server_identity_principal_id
  loki:
    clientId: $loki_identity_client_id
    principalId: $loki_identity_principal_id
  vmbackup:
    clientId: $vmbackup_identity_client_id
    principalId: $vmbackup_identity_principal_id
  veleroClusterBackup:
    clientId: $velero_identity_client_id
    principalId: $velero_identity_principal_id
EOF
upload_blob "${local_output}" "${remote_output}" --overwrite