#!/bin/bash
set -e

echo "=== Setting up kubectl for PRODUCTION ==="

mkdir -p ~/.aws
cat > ~/.aws/config << EOF
[default]
region = ${AWS_REGION:-ca-central-1}
EOF
cat > ~/.aws/credentials << EOF
[default]
aws_access_key_id = ${AWS_ACCESS_KEY_ID}
aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY}
EOF

if ! command -v kubectl &> /dev/null; then
    curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
    rm kubectl
fi

EKS_CLUSTER_NAME="${EKS_CLUSTER_NAME:-tbi-prod}"
AWS_REGION="${AWS_REGION:-ca-central-1}"

aws eks update-kubeconfig --name ${EKS_CLUSTER_NAME} --region ${AWS_REGION}
kubectl cluster-info

NAMESPACE="redtag"
if ! kubectl get namespace ${NAMESPACE} &> /dev/null; then
    kubectl create namespace ${NAMESPACE}
fi

if ! helm plugin list | grep -q secrets; then
    helm plugin install https://github.com/jkroepke/helm-secrets --version v4.5.1
fi
if ! helm plugin list | grep -q s3; then
    helm plugin install https://github.com/hypnoglow/helm-s3.git
fi
if ! command -v sops &> /dev/null; then
    wget https://github.com/mozilla/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64 -O /tmp/sops
    sudo mv /tmp/sops /usr/local/bin/sops
    sudo chmod +x /usr/local/bin/sops
fi

CURRENT_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
if [ "${CURRENT_ACCOUNT}" != "489176460030" ]; then
  echo "❌ Not using production account! Expected 489176460030, got ${CURRENT_ACCOUNT}"
  exit 1
fi
echo "✅ Production credentials verified (${CURRENT_ACCOUNT})"

echo "=== ✅ kubectl setup complete for PRODUCTION ==="