---
apiVersion: v1
kind: ConfigMap
metadata:
  name: metricsmultiplexer
data:
  entrypoint.sh: |
    #!/bin/sh

    # Generate self-signed SSL certs (not great!)
    apk add openssl && openssl req -x509 -nodes -days 365 -subj "/C=NA/ST=NA/O=NA/CN=NA" -newkey rsa:2048 -keyout /etc/nginx/ssl.key -out /etc/nginx/ssl.crt

    # Fill in the ServiceAccount token in the nginx config
    TOKEN=`cat /var/run/secrets/kubernetes.io/serviceaccount/token`
    cat multiplexer-nginx.conf | sed "s/KUBERNETESAUTHTOKEN/$TOKEN/" > /etc/nginx/conf.d/default.conf

    # Finally, start up nginx
    nginx -g 'daemon off;'

  multiplexer-nginx.conf: |
    server {
     listen 443 ssl;
     ssl_certificate      /etc/nginx/ssl.crt;
     ssl_certificate_key  /etc/nginx/ssl.key;

     resolver kube-dns.kube-system.svc.cluster.local valid=5s;

     # Ensure correct rewrites
     rewrite_log on;
     error_log   /dev/stdout notice;

     # Healthcheck
     location = /health {
       return 200 'ok';
     }

     # Authorization: use the ServiceAccount Token
     # (Replaced with actual value in entrypoint.sh)
     set $authz "Bearer KUBERNETESAUTHTOKEN";

     {{ range $.Values.metricsProviders }}
     # {{ .name }}
     set ${{ .name }} {{ .service }};
     location ~* /apis/external.metrics.k8s.io/v1beta1/namespaces/.*/{{ .prefix }} {
       {{ if .strip_prefix }}
       rewrite ^(/apis/external.metrics.k8s.io/v1beta1/namespaces/.*)/{{ .prefix }}(.*)$ $1/$2 break;
       {{ end }}
       proxy_set_header Authorization $authz;
       proxy_pass https://${{ .name }}$uri$is_args$args;
     }
     {{ end }}

     # Catch-all: API base
     set $defaultupstream {{ $.Values.defaultProviderUrl }};
     location ~* /apis/external.metrics.k8s.io/v1beta1/ {
       proxy_set_header Authorization $authz;
       proxy_pass https://$defaultupstream;
     }
     location / {
       proxy_set_header Authorization $authz;
       proxy_pass https://$defaultupstream;
     }
    }
