package overlay

import (
	corev1 "k8s.io/api/core/v1"
	"k8s.io/utils/pointer"
)

const (
	envNameAWSRoleARN              = "AWS_ROLE_ARN"
	envNameAWSRegion               = "AWS_REGION"
	envNameAWSDefaultRegion        = "AWS_DEFAULT_REGION"
	envNameAWSWebIdentityTokenFile = "AWS_WEB_IDENTITY_TOKEN_FILE"

	defaultAWSTokenFileDir  = "/var/run/secrets/eks.amazonaws.com/serviceaccount"
	defaultAWSTokenFileName = "token"
	defaultAWSTokenFile     = defaultAWSTokenFileDir + "/" + defaultAWSTokenFileName

	defaultAWSTokenVolumeName = "aws-iam-token"

	defaultAWSAudience               = "sts.amazonaws.com"
	defaultAWSTokenExpirationSeconds = 86400
)

func GetAWSEnv(roleARN, region string) []corev1.EnvVar {
	return []corev1.EnvVar{
		{
			Name:  envNameAWSRoleARN,
			Value: roleARN,
		},
		{
			Name:  envNameAWSRegion,
			Value: region,
		},
		{
			Name:  envNameAWSDefaultRegion,
			Value: region,
		},
		{
			Name:  envNameAWSWebIdentityTokenFile,
			Value: defaultAWSTokenFile,
		},
	}
}

func GetAWSProjectedVolume() *corev1.Volume {
	return &corev1.Volume{
		Name: defaultAWSTokenVolumeName,
		VolumeSource: corev1.VolumeSource{
			Projected: &corev1.ProjectedVolumeSource{
				Sources: []corev1.VolumeProjection{
					{
						ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
							Audience:          defaultAWSAudience,
							ExpirationSeconds: pointer.Int64(defaultAWSTokenExpirationSeconds),
							Path:              defaultAWSTokenFileName,
						},
					},
				},
			},
		},
	}
}

func GetAWSProjectedVolumeMount() *corev1.VolumeMount {
	return &corev1.VolumeMount{
		Name:      defaultAWSTokenVolumeName,
		MountPath: defaultAWSTokenFileDir,
		ReadOnly:  true,
	}
}