#!/usr/bin/env bash
# ingress-nginx/ingress-nginx 4.15.1 - base variant: internal-clusterip
# Path: fetch this entry's retained objects, check their SHA-256, then apply
# them with kubectl. It uses curl, shasum, awk and kubectl. It needs no cub
# CLI and no ConfigHub account.
# Generated by scripts/generate-public-site.mjs from this entry's listing:
# https://confighub.github.io/helm-expt/site/listings/ingress-nginx-ingress-nginx-4-15-1-internal-clusterip.json
# Entry page: https://confighub.github.io/helm-expt/site/charts/ingress-nginx-ingress-nginx-4-15-1.html
set -euo pipefail

say() { printf '\n>> %s\n' "$*"; }

for tool in curl awk kubectl; do
  if ! command -v "$tool" >/dev/null 2>&1; then
    printf '%s is required and was not found.\n' "$tool" >&2
    exit 1
  fi
done
if command -v shasum >/dev/null 2>&1; then
  sha256_of() { shasum -a 256 "$1" | awk '{print $1}'; }
elif command -v sha256sum >/dev/null 2>&1; then
  sha256_of() { sha256sum "$1" | awk '{print $1}'; }
else
  printf 'shasum is required and was not found.\n' >&2
  exit 1
fi

work=./ingress-nginx-ingress-nginx-4-15-1-internal-clusterip-objects
objects_url=https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/ingress-nginx/ingress-nginx/4.15.1/revisions/internal-clusterip/r001/rendered/release-objects.yaml
objects_sha256=a94ba2b56636baf7e732766c12c98d808b57c276156fa7a3a752b4137bf5f46a

say "Fetch the retained objects into $work/objects.yaml"
mkdir -p "$work"
curl -fsSL -o "$work/objects.yaml" "$objects_url"

say "Check the file against the SHA-256 in the listing"
fetched_sha256="$(sha256_of "$work/objects.yaml")"
if [ "$fetched_sha256" != "$objects_sha256" ]; then
  printf 'The file differs from the listing, so the script stops. Nothing was applied.\n  listing: %s\n  fetched: %s\n' "$objects_sha256" "$fetched_sha256" >&2
  exit 1
fi
printf 'The file matches: sha256 %s\n' "$fetched_sha256"

say "Split the file into its 9 objects. The cluster is untouched so far"
rm -rf "$work/docs" "$work/rest"
mkdir -p "$work/docs" "$work/rest"
awk -v dir="$work/docs" 'BEGIN { n = 0; f = sprintf("%s/doc-%04d.yaml", dir, n) } /^---[ \t]*$/ { close(f); n++; f = sprintf("%s/doc-%04d.yaml", dir, n); next } { print > f }' "$work/objects.yaml"
for n in 0001 0002 0003 0004 0005 0006 0007 0008 0009; do mv "$work/docs/doc-$n.yaml" "$work/rest/"; done
ls "$work/rest"

say "Check that kubectl reaches a cluster"
if ! kubectl get --raw /version >/dev/null 2>&1; then
  printf 'kubectl cannot reach a cluster. Point it at a throwaway cluster and re-run this script.\n' >&2
  exit 1
fi
kubectl config current-context 2>/dev/null || true

say "Create the ingress-nginx namespace if it does not exist"
if ! kubectl get namespace ingress-nginx >/dev/null 2>&1; then
  kubectl create namespace ingress-nginx
fi

say "Apply the 9 objects"
kubectl apply -f "$work/rest"

say "Done. kubectl applied the 9 objects of this entry's retained file."
say "The script stops here. It did not wait for any workload to start"
say "Not run by this script: 1 step of this entry's plan. The entry page says who runs it."
cat <<'EOF_NOT_RUN'
   - Lifecycle route for the packaged chart's 8 non-test hook occurrence(s). All eight hooks belong to the admission webhook's certificate Jobs, and this base turns the admission webhook off, so no hook applies and you do nothing for this step.
EOF_NOT_RUN