#!/usr/bin/env bash

sa_email=""
if [ $# -ge 1 ]; then
	sa_email="$1"
fi

if [ -z "${sa_email}" ]; then
	echo -e "\nPlease provide the service account email.\n\nUsage: $0 <iam-account-email> [<mode>]\n" && exit 1
fi

echo -e "\n(1/4) Before updating IAM policy binding in the service & host project..."
./list_roles.sh "${sa_email}"

echo -e "\n(2/4) Updating IAM policy binding in the service project..."
#interested_roles=("roles/compute.networkAdmin" "roles/iam.securityReviewer")
interested_roles=("roles/iam.securityReviewer")
for role in "${interested_roles[@]}"; do
	CMD="gcloud projects remove-iam-policy-binding openshift-qe-group-i-osd --member=\"serviceAccount:${sa_email}\" --role \"${role}\" 1>/dev/null"
	echo -e "\nRunning Command: ${CMD}"
	eval "${CMD}"
done

echo -e "\n(3/4) Updating IAM policy binding in the host project..."
interested_roles=("roles/compute.networkAdmin" "roles/compute.securityAdmin" "roles/dns.admin")
for role in "${interested_roles[@]}"; do
	CMD="gcloud projects add-iam-policy-binding openshift-qe-shared-vpc --member=\"serviceAccount:${sa_email}\" --role \"${role}\" 1>/dev/null"
	echo -e "\nRunning Command: ${CMD}"
	eval "${CMD}"
done

echo -e "\n(4/4) After updating IAM policy binding in the service & host project..."

level=error msg=failed to fetch Cluster: failed to generate asset \\\"Cluster\\\": failed to create cluster: failed during pre-provisioning: failed to add roles for shared VPC: failed to get IAM policy, unexpected error: googleapi: Error 403: The caller does not have permission, forbidden\\nlevel=warning msg=Failed to extract host addresses: failed to get bootstrap address: wrong number of bootstrap manifests found: []. Expected exactly one\\nlevel=fatal msg=must provide bootstrap host address\\n\" installID=wpgvdngm\ntime=\"2024-09-14T11:48:21Z\" level=debug msg=\"no additional log fields found\" installID=wpgvdngm\ntime=\"2024-09-14T11:48:21Z\" level=error msg=\"failed due to install error\" error=\"exit status 4\" installID=wpgvdngm\ntime=\"2024-09-14T11:48:21Z\" level=fatal msg=\"runtime error\" error=\"exit status 4\"\n"

$ ocm create cluster yisun-914-xpn-default-version --provider gcp --service-account-file /home/yisun/lento-sun/ocm_token/credentials/.gcp/osd-ccs-admin.json --ccs --region us-central1 --vpc-project-id openshift-qe-shared-vpc --vpc-name installer-shared-vpc --control-plane-subnet installer-shared-vpc-subnet-1 --compute-subnet installer-shared-vpc-subnet-2

ID:			2dphntfv830ff7i2bpvnbjvvt69pjcvh
External ID:		
Name:			yisun-914-xpn-default-version
Domain Prefix:		e7t3b9t7l7t3c9q
Display Name:		yisun-914-xpn-default-version
State:			waiting 

...

$ sh grant_sa_permission.sh osd-managed-admin-d6skvpgm@openshift-qe-group-i-osd.iam.gserviceaccount.com

$ sh time_cluster_ready.sh 2dphntfv830ff7i2bpvnbjvvt69pjcvh
Cluster '2dphntfv830ff7i2bpvnbjvvt69pjcvh' is now in 'installing' status after 0 mins.
Cluster '2dphntfv830ff7i2bpvnbjvvt69pjcvh' is now in 'installing' status after 1 mins.
Cluster '2dphntfv830ff7i2bpvnbjvvt69pjcvh' is now in 'installing' status after 2 mins.
...
Cluster '2dphntfv830ff7i2bpvnbjvvt69pjcvh' is now in 'ready' status after 35 mins.