#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

[ -r "${SCRIPT_DIR}/env-cert_manager" ] && . "${SCRIPT_DIR}/env-cert_manager"

CERT_MANAGER_NAMESPACE="${CERT_MANAGER_NAMESPACE:-cert-manager}"
CERT_MANAGER_VERSION="${CERT_MANAGER_VERSION:-v1.19.5}"
BUNDLE_URL="https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
BUNDLE_FILE="${SCRIPT_DIR}/cert-manager.yaml"

_kubectl() {
    if [ -f "/etc/kubernetes/admin.conf" ]; then
        KUBECONFIG=/etc/kubernetes/admin.conf command kubectl "$@"
    elif command -v kubectl &>/dev/null; then
        command kubectl "$@"
    else
        echo "ERROR: no kubectl found" >&2
        exit 127
    fi
}

CMD="${1:-install}"

if [ "${CMD}" = "delete" ]; then
    echo "[cert-manager] bundle removal skipped — run helm/kubectl uninstall manually if needed"
    echo "[cert-manager] ClusterIssuers are managed per-component; remove them via component delete"
    exit 0
fi

echo "[cert-manager] install version=${CERT_MANAGER_VERSION} namespace=${CERT_MANAGER_NAMESPACE}"

if [ ! -f "${BUNDLE_FILE}" ]; then
    echo "[cert-manager] downloading bundle from ${BUNDLE_URL}"
    curl -fsSL "${BUNDLE_URL}" -o "${BUNDLE_FILE}"
else
    echo "[cert-manager] bundle already present, skipping download"
fi

echo "[cert-manager] applying bundle (--server-side)"
_kubectl apply --server-side -f "${BUNDLE_FILE}"

echo "[cert-manager] waiting for cert-manager-webhook Available (up to 180s)"
_kubectl wait --for=condition=Available \
    deployment/cert-manager-webhook \
    --namespace "${CERT_MANAGER_NAMESPACE}" \
    --timeout=180s

echo "[cert-manager] waiting for ClusterIssuer CRD to be established (up to 60s)"
_kubectl wait --for=condition=established \
    crd/clusterissuers.cert-manager.io \
    --timeout=60s

if ! command -v kubectl-cert_manager >/dev/null 2>&1; then
    echo "[cert-manager] installing kubectl cert-manager plugin ${CERT_MANAGER_VERSION}"
    _ARCH="$(uname -m)"
    case "${_ARCH}" in
        x86_64)  _ARCH="amd64" ;;
        aarch64) _ARCH="arm64" ;;
        *)
            echo "[cert-manager] unsupported arch ${_ARCH} — skipping plugin install" >&2
            _ARCH=""
            ;;
    esac
    if [ -n "${_ARCH}" ]; then
        _PLUGIN_URL="https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/kubectl-cert_manager-linux-${_ARCH}.tar.gz"
        _TMP="$(mktemp -d)"
        curl -fsSL "${_PLUGIN_URL}" | tar -xz -C "${_TMP}"
        install -m 0755 "${_TMP}/kubectl-cert_manager" /usr/local/bin/kubectl-cert_manager
        rm -rf "${_TMP}"
        echo "[cert-manager] plugin installed → /usr/local/bin/kubectl-cert_manager"
    fi
else
    echo "[cert-manager] kubectl cert-manager plugin already present — skipping"
fi

echo "[cert-manager] done — $(date -Iseconds)"