#!/usr/bin/env bash
set -euo pipefail

# Colors
GREEN="\033[0;32m"
RED="\033[0;31m"
NC="\033[0m"

echo -e "${GREEN}🚀 Cluster Security Automation — Kubernetes + Ansible${NC}"

# Select inventory
ENVIRONMENT=${1:-"staging"}
INVENTORY="ansible/inventories/${ENVIRONMENT}/hosts.yml"

if [ ! -f "$INVENTORY" ]; then
  echo -e "${RED}❌ Inventory not found: $INVENTORY${NC}"
  exit 1
fi

echo -e "${GREEN}▶ Using inventory: $ENVIRONMENT${NC}"

# Step 1: Patch cluster nodes
echo -e "${GREEN}▶ Patching Kubernetes nodes...${NC}"
ansible-playbook -i "$INVENTORY" ansible/playbooks/patch-cluster.yaml

# Step 2: Run CIS benchmark checks
echo -e "${GREEN}▶ Running CIS compliance checks...${NC}"
ansible-playbook -i "$INVENTORY" ansible/playbooks/cis-check.yaml

# Step 3: Generate audit reports
echo -e "${GREEN}▶ Generating audit reports...${NC}"
ansible-playbook -i "$INVENTORY" ansible/playbooks/audit-report.yaml

echo -e "${GREEN}✅ Security automation completed for environment: $ENVIRONMENT${NC}"
echo -e "${GREEN}📂 Reports available in ./ansible/reports/${NC}"
