#!/usr/bin/env bash
# external-secrets/external-secrets 2.5.0 - base variant: no-crds
# Path: pull the package, render this base variant locally, read the objects,
# then apply them with kubectl. No ConfigHub account is needed.
# Generated by scripts/generate-public-site.mjs from the committed package
# data for this base variant. Chart page: https://confighub.github.io/helm-expt/site/charts/external-secrets-external-secrets-2-5-0.html
set -euo pipefail

say() { printf '\n>> %s\n' "$*"; }

if ! command -v cub >/dev/null 2>&1; then
  printf 'cub is not installed. Install the cub CLI with:\n  curl -fsSL https://hub.confighub.com/cub/install.sh | bash\nthen add ~/.confighub/bin to your PATH and re-run this script.\n' >&2
  exit 1
fi

# Installer is a cub plugin. Check it before this script does any work.
if ! cub installer --help >/dev/null 2>&1; then
  printf 'The cub installer plugin is missing. Follow https://confighub.github.io/helm-expt/site/try.html#install-cub, then re-run this script.\n' >&2
  exit 1
fi

if ! command -v kustomize >/dev/null 2>&1; then
  printf 'kustomize is missing. Follow https://confighub.github.io/helm-expt/site/try.html#install-cub, then re-run this script.\n' >&2
  exit 1
fi

if ! command -v kubectl >/dev/null 2>&1; then
  printf 'kubectl is required for the apply step.\n' >&2
  exit 1
fi

say "Pull the package and render the no-crds base variant into ./external-secrets-external-secrets-2-5-0-no-crds"
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/external-secrets-external-secrets:2.5.0 --base no-crds --work-dir ./external-secrets-external-secrets-2-5-0-no-crds --non-interactive --namespace external-secrets

say "Read what was rendered; nothing has touched the cluster yet"
ls ./external-secrets-external-secrets-2-5-0-no-crds/out/manifests

wait_for_crd() {
  crd_name="$1"
  deadline=$(( $(date +%s) + 180 ))
  until kubectl get "crd/${crd_name}" >/dev/null 2>&1; do
    if [ "$(date +%s)" -ge "$deadline" ]; then
      printf "CRD %s did not appear within 180 seconds.\n" "$crd_name" >&2
      return 1
    fi
    sleep 2
  done
  kubectl wait --for=condition=Established --timeout=120s "crd/${crd_name}"
}

say "Ensure the external-secrets namespace exists"
kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f -

say "Check 23 CRDs included with this package"
missing_crds=0
if ! kubectl get crd/acraccesstokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/cloudsmithaccesstokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/clusterexternalsecrets.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/clustergenerators.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/clusterpushsecrets.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/clustersecretstores.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/ecrauthorizationtokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/externalsecrets.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/fakes.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/gcraccesstokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/generatorstates.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/githubaccesstokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/grafanas.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/mfas.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/passwords.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/pushsecrets.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/quayaccesstokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/secretstores.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/sshkeys.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/stssessiontokens.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/uuids.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/vaultdynamicsecrets.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if ! kubectl get crd/webhooks.generators.external-secrets.io >/dev/null 2>&1; then
  missing_crds=1
fi
if [ "$missing_crds" -eq 1 ]; then
  kubectl apply --server-side -f ./external-secrets-external-secrets-2-5-0-no-crds/package/prerequisites/target-facts/no-crds-crds.yaml
else
  say "The required CRDs already exist; leave them under their current owner"
fi
wait_for_crd acraccesstokens.generators.external-secrets.io
wait_for_crd cloudsmithaccesstokens.generators.external-secrets.io
wait_for_crd clusterexternalsecrets.external-secrets.io
wait_for_crd clustergenerators.generators.external-secrets.io
wait_for_crd clusterpushsecrets.external-secrets.io
wait_for_crd clustersecretstores.external-secrets.io
wait_for_crd ecrauthorizationtokens.generators.external-secrets.io
wait_for_crd externalsecrets.external-secrets.io
wait_for_crd fakes.generators.external-secrets.io
wait_for_crd gcraccesstokens.generators.external-secrets.io
wait_for_crd generatorstates.generators.external-secrets.io
wait_for_crd githubaccesstokens.generators.external-secrets.io
wait_for_crd grafanas.generators.external-secrets.io
wait_for_crd mfas.generators.external-secrets.io
wait_for_crd passwords.generators.external-secrets.io
wait_for_crd pushsecrets.external-secrets.io
wait_for_crd quayaccesstokens.generators.external-secrets.io
wait_for_crd secretstores.external-secrets.io
wait_for_crd sshkeys.generators.external-secrets.io
wait_for_crd stssessiontokens.generators.external-secrets.io
wait_for_crd uuids.generators.external-secrets.io
wait_for_crd vaultdynamicsecrets.generators.external-secrets.io
wait_for_crd webhooks.generators.external-secrets.io

if [ "${REQUIREMENTS_READY:-0}" != "1" ]; then
  cat >&2 <<'EOF_REQUIREMENTS'
This base variant needs resources you must create with your own values first:
  - Secret external-secrets/external-secrets-webhook
    kubectl -n external-secrets apply -f <work-dir>/out/secrets/secret-external-secrets-external-secrets-webhook.yaml
Complete these prerequisites before applying the rendered objects.
Replace any <...> placeholders with values or files for your environment.
When the resources exist, re-run with:
  REQUIREMENTS_READY=1 bash try.sh
EOF_REQUIREMENTS
  exit 1
fi

if [ -d ./external-secrets-external-secrets-2-5-0-no-crds/out/secrets ]; then
  say "Apply rendered Secrets first"
  kubectl apply -f ./external-secrets-external-secrets-2-5-0-no-crds/out/secrets
fi

say "Apply the rendered objects"
kubectl apply -f ./external-secrets-external-secrets-2-5-0-no-crds/out/manifests

say "Done. The cluster received exactly the files in ./external-secrets-external-secrets-2-5-0-no-crds/out."