apiVersion: v1
kind: ConfigMap
metadata:
  name: opsman-config-pks-script
data:
  run.sh: |
    #!/bin/bash
    set -eux

    SKIP_DOWNLOAD=
    echo "====> Waiting for opsman to respond with real cert"
    until $(curl --output /dev/null --silent --head --fail https://${OM_TARGET}/setup); do
      printf '.'
      sleep 5
    done

    om_generate_cert() (
      local domains="$1"
      local data=$(echo $domains | jq --raw-input -c '{"domains": (. | split(" "))}')
      local response=$(
        om -k \
            curl \
            --silent \
            --path "/api/v0/certificates/generate" \
            -x POST \
            -d $data
        )
        echo "$response"
    )

    cat << EOF > /tmp/keys.yaml
    ---
    product-properties:
      .pivotal-container-service.pks_tls:
        value:
          cert_pem: |-
    $(cat /etc/pks/certs/tls.crt | sed 's/^/        /')
          private_key_pem: |-
    $(cat /etc/pks/certs/tls.key | sed 's/^/        /')
    EOF
    echo "====> check if we already have pks staged"
    if om -k staged-config --product-name pivotal-container-service > /dev/null; then
      echo "====> check if its the current version"
      if om -k staged-products | grep "pivotal-container-service" | grep "${VERSION}" > /dev/null; then
        echo "Current version of PKS already staged, skipping download"
        SKIP_DOWNLOAD=true
      fi
    fi
    if [[ -z "${SKIP_DOWNLOAD}" ]]; then
        echo "====> downloading pks product and stemcell"
        om -k --request-timeout 3600 \
          download-product \
          --pivnet-api-token=${PIVNET_API_TOKEN} \
          --output-directory=/tmp \
          --pivnet-file-glob 'pivotal-container-service*.pivotal' \
          --product-version "${VERSION}" \
          --pivnet-product-slug 'pivotal-container-service' \
          --stemcell-iaas google --download-stemcell

        echo "====> uploading pks tile"
        FILENAME=$(cat /tmp/download-file.json | jq -r ".product_path")
        om -k \
          --request-timeout 3600 upload-product -p ${FILENAME}

        echo "====> uploading stemcell"
        STEMCELL=$(cat /tmp/download-file.json | jq -r ".stemcell_path")
        om -k \
          --request-timeout 3600 upload-stemcell \
          --stemcell ${STEMCELL}

      echo "====> staging PKS"
      PRODUCT_NAME=$(om -k tile-metadata \
        --product-path /tmp/pivotal-container-service-*.pivotal \
        --product-name)

      PRODUCT_VERSION=$(om -k tile-metadata \
        --product-path /tmp/pivotal-container-service-*.pivotal \
        --product-version)

      om -k --request-timeout 3600 \
          stage-product \
          --product-name "${PRODUCT_NAME}" \
          --product-version "${PRODUCT_VERSION}"
    fi

    # combine pks and keys
    echo "====> configuring PKS"
    echo "--> combine config with TLS certs"
    yq m -x /etc/pks/config/pks.yaml /tmp/keys.yaml > /tmp/pks-with-keys.yaml
    echo "--> configure product"
    om -k --request-timeout 3600 \
        configure-product \
        --config /tmp/pks-with-keys.yaml

    echo "====> apply changes"
    om -k --request-timeout 3600 \
        apply-changes

    echo "PKS API: https://${DNS}:9021"
    echo "UAA: https://${DNS}:8443"

  create_user.sh: |
    #!/bin/bash

    set -eux

    echo "====> Waiting for opsman to respond with real cert"
    until $(curl --output /dev/null --silent --head --fail https://${OM_TARGET}/setup); do
      printf '.'
      sleep 5
    done

    echo "====> log into UAA"
    UAA_CRED=$(om credentials --product-name pivotal-container-service \
      --credential-reference .properties.pks_uaa_management_admin_client \
      --credential-field secret)

    uaa target https://${DNS}:8443

    uaa get-client-credentials-token admin -s "$UAA_CRED"

    echo "====> check if user ${PKS_USERNAME} exists"
    if ! uaa get-user ${PKS_USERNAME} > /dev/null; then
      echo "--> create user ${PKS_USERNAME}"
      uaa create-user ${PKS_USERNAME} --email ${PKS_USERNAME}@${DNS} \
        -p ${PKS_PASSWORD} --familyName ${PKS_USERNAME} --givenName ${PKS_USERNAME}
      echo "--> add user ${PKS_USERNAME} to pks.clusters.admin"
      uaa add-member pks.clusters.admin ${PKS_USERNAME}
    else
      echo "user ${PKS_USERNAME} already exists"
    fi

    echo "====> Finished!"
    echo "log into PKS with -"
    echo '$ pks login -k -a pks.demo.paulczar.wtf -u "pksadmin" -p "XXXXXX"'
