#!/bin/bash

# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0

set -euo pipefail

# When the kubeconfig is generated by gcloud below, this env var asks gcloud to use the new
# gke-gcloud-auth-plugin client credentials auth plugin in the kubeconfig file.
# See https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke
export USE_GKE_GCLOUD_AUTH_PLUGIN=True

cd deploy-gke-cluster-output
gcloud auth activate-service-account "$GCP_SERVICE_ACCOUNT" --key-file <(echo "$GCP_JSON_KEY") --project "$GCP_PROJECT"


if [ -n "$KUBE_VERSION" ]; then
  echo
  echo "Trying to use Kubernetes version $KUBE_VERSION"

  # Look up the latest GKE version for KUBE_VERSION.
  GKE_VERSIONS="$(gcloud container get-server-config --zone "$CLUSTER_ZONE" --format json \
    | jq -r '.validMasterVersions[]')"
  echo
  echo "Found all versions of Kubernetes supported by GKE:"
  echo "$GKE_VERSIONS"

  GKE_VERSION="$(echo "$GKE_VERSIONS" | grep -F "$KUBE_VERSION" \
    | sort -rn \
    | head -1)"
  echo
  echo "Selected GKE version $GKE_VERSION"

  export VERSION_FLAG="--cluster-version=$GKE_VERSION"
else
  export VERSION_FLAG="--release-channel=${GKE_CHANNEL:-"regular"}"
fi

# Include the zone of the cluster in its name. This will allow us to change our preferred zone for new
# clusters anytime we want, and the existing clusters can still be deleted because the old zone can
# be parsed out from the cluster name at deletion time.
CLUSTER_NAME="gke-$(openssl rand -hex 4)-zone-${CLUSTER_ZONE}"

# The cluster name becomes the name of the lock in the pool.
echo "$CLUSTER_NAME" > name

# Start the cluster
# Note that --enable-network-policy is required to enable NetworkPolicy resources. Otherwise they are ignored.
gcloud container clusters create "$CLUSTER_NAME" \
  --zone "$CLUSTER_ZONE" \
  "$VERSION_FLAG" \
  --num-nodes 1 \
  --machine-type e2-standard-4 \
  --preemptible \
  --issue-client-certificate \
  --no-enable-basic-auth \
  --enable-network-policy

# Get the cluster details back, including the admin certificate:
gcloud container clusters describe "$CLUSTER_NAME" --zone "$CLUSTER_ZONE" --format json \
  > /tmp/cluster.json

# Make a new kubeconfig user "cluster-admin" using the admin cert.
jq -r .masterAuth.clientCertificate /tmp/cluster.json | base64 -d > /tmp/client.crt
jq -r .masterAuth.clientKey /tmp/cluster.json | base64 -d > /tmp/client.key
kubectl config set-credentials cluster-admin \
  --client-certificate=/tmp/client.crt \
  --client-key=/tmp/client.key

# Give the "client" user cluster-admin access
kubectl create clusterrolebinding test-client-is-admin --clusterrole cluster-admin --user client

# Set the kubeconfig context to use the cluster-admin user.
kubectl config set-context --current --user cluster-admin

# The kubeconfig file becomes the value of the lock in the pool.
kubectl config view --minify --flatten -o yaml > metadata