#!/usr/bin/env bash
# jetstack/cert-manager v1.20.2 - base variant: default
# Path: fetch this entry's retained objects, check their SHA-256, then apply
# them with kubectl. It uses curl, shasum, awk and kubectl. It needs no cub
# CLI and no ConfigHub account.
# Generated by scripts/generate-public-site.mjs from this entry's listing:
# https://confighub.github.io/helm-expt/site/listings/jetstack-cert-manager-v1-20-2-default.json
# Entry page: https://confighub.github.io/helm-expt/site/charts/jetstack-cert-manager-v1-20-2.html
set -euo pipefail

say() { printf '\n>> %s\n' "$*"; }

for tool in curl awk kubectl; do
  if ! command -v "$tool" >/dev/null 2>&1; then
    printf '%s is required and was not found.\n' "$tool" >&2
    exit 1
  fi
done
if command -v shasum >/dev/null 2>&1; then
  sha256_of() { shasum -a 256 "$1" | awk '{print $1}'; }
elif command -v sha256sum >/dev/null 2>&1; then
  sha256_of() { sha256sum "$1" | awk '{print $1}'; }
else
  printf 'shasum is required and was not found.\n' >&2
  exit 1
fi

work=./jetstack-cert-manager-v1-20-2-default-objects
objects_url=https://raw.githubusercontent.com/confighub/helm-expt/main/recipes/jetstack/cert-manager/v1.20.2/revisions/default/r001/rendered/release-objects.yaml
objects_sha256=45029db19d75e578bec74b82a0476a6580d1f7193239a210bf4873156ac725ce

say "Fetch the retained objects into $work/objects.yaml"
mkdir -p "$work"
curl -fsSL -o "$work/objects.yaml" "$objects_url"

say "Check the file against the SHA-256 in the listing"
fetched_sha256="$(sha256_of "$work/objects.yaml")"
if [ "$fetched_sha256" != "$objects_sha256" ]; then
  printf 'The file differs from the listing, so the script stops. Nothing was applied.\n  listing: %s\n  fetched: %s\n' "$objects_sha256" "$fetched_sha256" >&2
  exit 1
fi
printf 'The file matches: sha256 %s\n' "$fetched_sha256"

say "Split the file into its 42 objects. The cluster is untouched so far"
rm -rf "$work/docs" "$work/rest"
mkdir -p "$work/docs" "$work/rest"
awk -v dir="$work/docs" 'BEGIN { n = 0; f = sprintf("%s/doc-%04d.yaml", dir, n) } /^---[ \t]*$/ { close(f); n++; f = sprintf("%s/doc-%04d.yaml", dir, n); next } { print > f }' "$work/objects.yaml"
for n in 0001 0002 0003 0004 0005 0006 0007 0008 0009 0010 0011 0012; do mv "$work/docs/doc-$n.yaml" "$work/rest/"; done
for n in 0013 0014 0015 0016 0017 0018 0019 0020 0021 0022 0023 0024; do mv "$work/docs/doc-$n.yaml" "$work/rest/"; done
for n in 0025 0026 0027 0028 0029 0030 0031 0032 0033 0034 0035 0036; do mv "$work/docs/doc-$n.yaml" "$work/rest/"; done
for n in 0037 0038 0039 0040 0041 0042; do mv "$work/docs/doc-$n.yaml" "$work/rest/"; done
ls "$work/rest"

if [ "${REQUIREMENTS_READY:-0}" != "1" ]; then
  say "Stop before applying anything. This entry's plan has 1 step that an install needs first"
  cat >&2 <<'EOF_REQUIREMENTS'
This script cannot carry out this step of the plan. It is yours to do, with your own values:
  - The installer package includes these CRDs as prerequisites/target-facts/default-crds.yaml. Apply the missing CRDs server-side and leave existing CRDs under their current owner. The listing gives the rest.
Nothing was applied. Complete it before you apply the objects.
When it is done, re-run with:
  REQUIREMENTS_READY=1 bash try-objects.sh
EOF_REQUIREMENTS
  exit 1
fi
say "REQUIREMENTS_READY=1 is set. The script takes your word for 1 step and does not check it"

say "Check that kubectl reaches a cluster"
if ! kubectl get --raw /version >/dev/null 2>&1; then
  printf 'kubectl cannot reach a cluster. Point it at a throwaway cluster and re-run this script.\n' >&2
  exit 1
fi
kubectl config current-context 2>/dev/null || true

say "Create the cert-manager namespace if it does not exist"
if ! kubectl get namespace cert-manager >/dev/null 2>&1; then
  kubectl create namespace cert-manager
fi

say "Create the kube-system namespace if it does not exist"
if ! kubectl get namespace kube-system >/dev/null 2>&1; then
  kubectl create namespace kube-system
fi

say "Apply the 42 objects"
kubectl apply -f "$work/rest"

say "Done. kubectl applied the 42 objects of this entry's retained file."
say "The script stops here. It did not wait for any workload to start"
say "Not run by this script: 1 step of this entry's plan. The entry page says who runs it."
cat <<'EOF_NOT_RUN'
   - The installer package includes these CRDs as prerequisites/target-facts/default-crds.yaml. Apply the missing CRDs server-side and leave existing CRDs under their current owner. The listing gives the rest.
EOF_NOT_RUN