#!/bin/bash

# print a message to stderr, prefixed by HOSTNAME
function note() {
  echo 1>&2 "$HOSTNAME: $*"
}

# print the given command to stderr, run it, and exit verbosely if it fails.
function xrun() {
  note "+ $@"
  "$@" && return 0
  local xstat=$?
  note "Cmd $1 failed, exit $xstat"
  exit "$xstat"
}

# ----- start of mainline code

HOSTNAME=$(hostname)

# export variables used to create the KSA and ingress gateway
export CLUSTER_NAME="${anthos_user_cluster_name}"
export KSA_NAME=gke-connect-admin

note "# create the KSA"
xrun kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig create serviceaccount $KSA_NAME

note "# role bind cluster admin to the KSA"
kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig create clusterrolebinding $KSA_NAME --clusterrole cluster-admin --serviceaccount=default:$KSA_NAME

note "# capture the token for the KSA"
TOKEN_SECRET=`kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig get serviceaccounts $KSA_NAME -o yaml | \
grep $KSA_NAME-token | awk -F": " '{print $2}'`

note "# save the KSA to a file"
echo `kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig get secret $TOKEN_SECRET -o yaml | grep "token:" | awk -F": " '{print $2}' | base64 -d` > ${ksa_token_path}


note "# create a ca cert used for the ingress gateway"
xrun openssl \
req  \
-nodes -new -x509 \
-keyout ~/ingress-wildcard.key \
-out ~/ingress-wildcard.crt \
-subj "/C=US/ST=CA/L=Sunnyvale/O=On-Prem\
/OU=GKE/CN=www.gkeonprem.com/emailAddress=dev@gkeonprem.com"


note "# apply the cert to the cluster"
xrun kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig \
    create secret tls \
    --namespace gke-system \
    ingressgateway-wildcard-cacerts \
    --cert ~/ingress-wildcard.crt \
    --key ~/ingress-wildcard.key


note "# create the yaml for the cluster ingress gateway"
cat <<EOF > ingress-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-autogenerated-k8s-ingress
  namespace: gke-system
spec:
  selector:
    istio: ingress-gke-system
  servers:
  - port:
      number: 80
      protocol: HTTP2
      name: http
    hosts:
    - "*"
  - hosts:
    - "*.gkeonprem.com"
    port: 
      name: https-wildcard
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: ingressgateway-wildcard-cacerts
EOF


note "# apply the ingress gateway yaml file"
xrun kubectl --kubeconfig ~/cluster/$CLUSTER_NAME-kubeconfig \
	 apply -f ingress-gateway.yaml
