#!/bin/bash
set -e

echo "=== Setting up kubectl and helm-secrets ==="

# Install kubectl if not already installed
if ! command -v kubectl &> /dev/null; then
    echo "Installing kubectl..."
    curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
    rm kubectl
else
    echo "kubectl already installed"
    kubectl version --client
fi

# Target the PROD-account UAT cluster (489176460030).
# Both dev and prod accounts have a cluster named "uat" — the AWS account
# credentials (CircleCI context) determine which one we connect to.
# This job MUST run under devops-mgt-prod. The guard below fails loudly otherwise.
EKS_ACCOUNT_ID="489176460030"
CLUSTER_NAME="uat"
AWS_REGION="${AWS_REGION:-ca-central-1}"

CURRENT_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
if [ "${CURRENT_ACCOUNT}" != "${EKS_ACCOUNT_ID}" ]; then
    echo "❌ Wrong AWS account! Expected ${EKS_ACCOUNT_ID}, got ${CURRENT_ACCOUNT}"
    echo "   Ensure the deploy job uses the 'devops-mgt-prod' CircleCI context."
    exit 1
fi
echo "✅ Prod-account credentials verified (${CURRENT_ACCOUNT})"

EKS_ROLE_ARN="arn:aws:iam::${EKS_ACCOUNT_ID}:role/eksAdmin"
echo "Getting kubeconfig for cluster: ${CLUSTER_NAME} (role: ${EKS_ROLE_ARN})"
aws eks update-kubeconfig --region ${AWS_REGION} --name ${CLUSTER_NAME} --role-arn ${EKS_ROLE_ARN}


# Verify kubectl connection
kubectl config current-context
kubectl get nodes --no-headers | wc -l | xargs echo "Connected to cluster with nodes:"

# Install helm-secrets plugin if not already installed
if ! helm plugin list | grep -q secrets; then
    echo "Installing helm-secrets plugin..."
    helm plugin install https://github.com/jkroepke/helm-secrets --version v4.4.2
else
    echo "helm-secrets plugin already installed"
fi

# Install helm-s3 plugin for S3 Helm repository management
echo "Installing helm-s3 plugin..."
if ! helm plugin list | grep -q s3; then
    helm plugin install https://github.com/hypnoglow/helm-s3.git
else
    echo "helm-s3 plugin already installed"
fi

# Install helm-s3 plugin for S3 Helm repository management
echo "Installing helm-s3 plugin..."
if ! helm plugin list | grep -q s3; then
    helm plugin install https://github.com/hypnoglow/helm-s3.git
else
    echo "helm-s3 plugin already installed"
fi

# Install SOPS for helm-secrets
echo "Installing sops..."
if ! command -v sops &> /dev/null; then
    wget https://github.com/mozilla/sops/releases/download/v3.8.1/sops-v3.8.1.linux.amd64 -O /tmp/sops
    sudo mv /tmp/sops /usr/local/bin/sops
    sudo chmod +x /usr/local/bin/sops
else
    echo "sops already installed"
    sops --version
fi

# Verify helm-secrets installation
helm secrets --help > /dev/null && echo "✓ helm-secrets is ready"

# Create tbi-dev AWS profile alias (SOPS .sops.yaml requires aws_profile: tbi-dev)
echo "Setting up tbi-dev AWS profile for SOPS decryption..."
mkdir -p ~/.aws
cat >> ~/.aws/credentials << EOF
[tbi-dev]
aws_access_key_id=${AWS_ACCESS_KEY_ID}
aws_secret_access_key=${AWS_SECRET_ACCESS_KEY}
EOF

cat >> ~/.aws/config << EOF
[profile tbi-dev]
region=${AWS_REGION:-ca-central-1}
EOF
echo "✓ tbi-dev AWS profile configured"

echo "✓ kubectl and helm-secrets setup complete"