#/bin/bash
set -e
SECRETNAME="cloudwatch-credentials"
CredentialsRequests_dir="CredentialsRequests_dir"
mkdir -p ${CredentialsRequests_dir}

if ! oc get secret -n kube-system >/dev/null; then
    echo " Error: Only cluster admin can run this script"
    exit 1
fi

echo "step 1: create CredentialsRequest resource"
cat <<EOF >$CredentialsRequests_dir/openshift-logging-cloudwatch.json
{
    "apiVersion": "cloudcredential.openshift.io/v1",
    "kind": "CredentialsRequest",
    "metadata": {
        "annotations": {
            "include.release.openshift.io/ibm-cloud-managed": "true",
            "include.release.openshift.io/self-managed-high-availability": "true",
            "include.release.openshift.io/single-node-developer": "true"
        },
        "labels": {
            "controller-tools.k8s.io": "1.0"
        },
        "name": "openshift-logging-cloudwatch",
        "namespace": "openshift-cloud-credential-operator"
    },
    "spec": {
        "providerSpec": {
            "apiVersion": "cloudcredential.openshift.io/v1",
            "kind": "AWSProviderSpec",
            "statementEntries": [
                {
                    "action": [
                        "logs:PutLogEvents",
                        "logs:CreateLogGroup",
                        "logs:PutRetentionPolicy",
                        "logs:CreateLogStream",
                        "logs:DescribeLogGroups",
                        "logs:DescribeLogStreams"
                    ],
                    "effect": "Allow",
                    "resource": "arn:aws:logs:*:*:*"
                }
            ]
        },
        "secretRef": {
            "name": "${SECRETNAME}",
            "namespace": "openshift-logging"
        },
        "serviceAccountNames": [
            "logcollector"
        ]
    }
}
EOF
ls -l $CredentialsRequests_dir/

echo "step 2: Get account_id,oidc_arn and cluster_infra_name"
oc extract secret/installer-cloud-credentials -n openshift-image-registry --confirm >/dev/null
image_registry_roles_arn=$(cat credentials  |grep role_arn)
image_registry_roles_arn=${image_registry_roles_arn#role_arn = }
arn_aws_iam_account_id=${image_registry_roles_arn%:role*}
echo "account_id=$arn_aws_iam_account_id"

service_account_issuer=$(oc get authentication cluster -o json |jq '.spec.serviceAccountIssuer' -r)
service_account_issuer=${service_account_issuer#https://}
echo "issuer=$service_account_issuer"
cluster_infra_name=${service_account_issuer%-oidc*}
echo "infra_name=$cluster_infra_name"
cluster_oidc_arn=${arn_aws_iam_account_id}:oidc-provider/${service_account_issuer}
echo "oidc_arn=$cluster_oidc_arn"

echo "step 3: Extract the ccoctl binanry from cco_image"
if [[ ! -f ccoctl ]] ;then
    cluster_verison=$(oc get clusterversion version -o json | jq -r '.status.desired.version')
    release_image=$(oc get clusterversion version -o json | jq -r ".status.history[] | select(.version == \"${cluster_verison}\") | .image")
    cco_image=$(oc adm release info --image-for='cloud-credential-operator' $release_image)
    oc image extract $cco_image --file="/usr/bin/ccoctl"
    chmod +x ./ccoctl
else
   echo "Found ./ccoctl"
fi

echo "step 4: create-iam-roles and secret"
if [[ ! -f manifests/openshift-logging-cloudwatch-credentials-credentials.yaml ]]; then
    echo .ccoctl aws create-iam-roles --name ${cluster_infra_name} --credentials-requests-dir $CredentialsRequests_dir --identity-provider-arn ${cluster_oidc_arn}
    ./ccoctl aws create-iam-roles --name ${cluster_infra_name} --credentials-requests-dir $CredentialsRequests_dir --identity-provider-arn ${cluster_oidc_arn}
else
   echo "Found exisiting manifests/openshift-logging-cloudwatch-credentials-credentials.yaml"
fi
echo "Create openshift-logging-cloudwatch secret"
#oc create -f manifests/openshift-logging-cloudwatch-credentials-credentials.yaml

oc create secret generic ${SECRETNAME} -n openshift-logging --from-literal=role_arn=${arn_aws_iam_account_id}:role/${cluster_infra_name}-openshift-logging-${SECRETNAME}

