#!/bin/bash
set -e

echo "=== Setting up kubectl for PRODUCTION (tbi-prod) ==="

# Configure AWS CLI to use CircleCI context credentials instead of instance role
echo "Configuring AWS credentials from CircleCI context..."
mkdir -p ~/.aws

cat > ~/.aws/config << EOF
[default]
region = ${AWS_REGION:-ca-central-1}
EOF

cat > ~/.aws/credentials << EOF
[default]
aws_access_key_id = ${AWS_ACCESS_KEY_ID}
aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY}
EOF

echo "✅ AWS credentials configured (account: $(aws sts get-caller-identity --query Account --output text 2>/dev/null || echo 'unknown'))"
echo ""

# Install kubectl if not already installed
if ! command -v kubectl &> /dev/null; then
    echo "Installing kubectl..."
    curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
    rm kubectl
else
    echo "kubectl already installed"
    kubectl version --client
fi

# PRODUCTION cluster configuration. The prod/ env folder deploys to the tbi-prod EKS cluster.
EKS_CLUSTER_NAME="${EKS_CLUSTER_NAME:-tbi-prod}"
AWS_REGION="${AWS_REGION:-ca-central-1}"

# Validate cluster name is set
if [ -z "${EKS_CLUSTER_NAME}" ]; then
    echo "ERROR: EKS_CLUSTER_NAME environment variable is not set!"
    echo "Expected: tbi-prod"
    exit 1
fi

# Production safety check - ensure we're connecting to a prod cluster
if [[ ! "${EKS_CLUSTER_NAME}" =~ prod ]]; then
    echo "⚠️  WARNING: EKS_CLUSTER_NAME does not contain 'prod'"
    echo "Expected: tbi-prod"
    echo "Got: ${EKS_CLUSTER_NAME}"
    echo "Refusing to connect to non-production cluster in production pipeline!"
    exit 1
fi

echo "🔒 Connecting to PRODUCTION cluster: ${EKS_CLUSTER_NAME} in region: ${AWS_REGION}"
aws eks update-kubeconfig --name ${EKS_CLUSTER_NAME} --region ${AWS_REGION}

# Verify connection
echo "Verifying kubectl connection to PRODUCTION..."
kubectl cluster-info

# Additional production validation
CURRENT_CONTEXT=$(kubectl config current-context)
echo "Current context: ${CURRENT_CONTEXT}"

if [[ ! "${CURRENT_CONTEXT}" =~ prod ]]; then
    echo "❌ ERROR: Not connected to production cluster!"
    echo "Current context: ${CURRENT_CONTEXT}"
    echo "Expected context containing 'prod'"
    exit 1
fi

echo "✅ Confirmed connection to PRODUCTION cluster"

# Ensure redtag namespace exists (tbi-rlv-vacations-service is deployed to redtag)
NAMESPACE="redtag"
if ! kubectl get namespace ${NAMESPACE} &> /dev/null; then
    echo "Creating ${NAMESPACE} namespace in PRODUCTION..."
    kubectl create namespace ${NAMESPACE}
else
    echo "${NAMESPACE} namespace already exists in PRODUCTION"
fi

# Install helm-secrets plugin
echo "Installing helm-secrets plugin..."
if ! helm plugin list | grep -q secrets; then
    helm plugin install https://github.com/jkroepke/helm-secrets --version v4.5.1
else
    echo "helm-secrets plugin already installed"
fi

# Install helm-s3 plugin for S3 Helm repository management
echo "Installing helm-s3 plugin..."
if ! helm plugin list | grep -q s3; then
    helm plugin install https://github.com/hypnoglow/helm-s3.git
else
    echo "helm-s3 plugin already installed"
fi

# Install SOPS for helm-secrets
echo "Installing sops..."
if ! command -v sops &> /dev/null; then
    wget https://github.com/mozilla/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64 -O /tmp/sops
    sudo mv /tmp/sops /usr/local/bin/sops
    sudo chmod +x /usr/local/bin/sops
else
    echo "sops already installed"
    sops --version
fi

# Verify production credentials for cross-account KMS access
echo ""
echo "Verifying production credentials for cross-account KMS access..."

# Production setup:
# - Account 489176460030: EKS cluster (tbi-prod) + kubectl + SOPS
# - Account 495680544243: KMS key for secret encryption
# - KMS key policy allows cross-account access from the production account
# KMS Key: arn:aws:kms:ca-central-1:495680544243:key/99547b03-9580-403f-8579-ea1595335830

CURRENT_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
CURRENT_ARN=$(aws sts get-caller-identity --query Arn --output text)

echo "Current AWS Account: ${CURRENT_ACCOUNT}"
echo "Current AWS ARN: ${CURRENT_ARN}"

# Verify we're using production account credentials
if [ "${CURRENT_ACCOUNT}" != "489176460030" ]; then
  echo "❌ ERROR: Not using production account credentials!"
  echo "Expected account: 489176460030"
  echo "Current account: ${CURRENT_ACCOUNT}"
  exit 1
fi

echo "✅ Production credentials verified"
echo "NOTE: Both kubectl and SOPS use production credentials (489176460030)"
echo "      SOPS accesses the KMS key via cross-account policy (495680544243)"

echo "=== ✅ kubectl and helm-secrets setup complete for PRODUCTION ==="