#!/usr/bin/env bash
set -euo pipefail

[ -r "./env-hccm" ] && . ./env-hccm

HCCM_VERSION="${HCCM_VERSION:-1.30.1}"
HCCM_NETWORK="${HCCM_NETWORK:?ERROR: HCCM_NETWORK must be set (Hetzner private network name)}"
HCCM_TOKEN_SECRET="${HCCM_TOKEN_SECRET:-hcloud}"
HCCM_LOAD_BALANCER_LOCATION="${HCCM_LOAD_BALANCER_LOCATION:-fsn1}"

MANIFEST_URL="https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/download/v${HCCM_VERSION}/ccm-networks.yaml"

echo "=== hccm: checking prerequisites ==="

if ! kubectl version --client=true &>/dev/null; then
  echo "ERROR: kubectl not found" >&2
  exit 1
fi

if ! kubectl -n kube-system get secret "${HCCM_TOKEN_SECRET}" &>/dev/null; then
  echo "ERROR: Secret '${HCCM_TOKEN_SECRET}' not found in kube-system." >&2
  echo "       Create it first: kubectl -n kube-system create secret generic ${HCCM_TOKEN_SECRET} \\" >&2
  echo "         --from-literal=token=<HCLOUD_TOKEN> \\" >&2
  echo "         --from-literal=network=${HCCM_NETWORK}" >&2
  exit 1
fi

# Skip if already running and healthy
if kubectl -n kube-system rollout status deployment/hcloud-cloud-controller-manager --timeout=5s &>/dev/null; then
  RUNNING_VERSION="$(kubectl -n kube-system get deployment hcloud-cloud-controller-manager \
    -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null | cut -d: -f2 || echo "")"
  if [ "${RUNNING_VERSION}" = "v${HCCM_VERSION}" ]; then
    echo "=== hccm: already running v${HCCM_VERSION} — skipping install ==="
    exit 0
  fi
  echo "=== hccm: upgrading ${RUNNING_VERSION} → v${HCCM_VERSION} ==="
fi

echo "=== hccm: deploying v${HCCM_VERSION} (network=${HCCM_NETWORK}, lb-location=${HCCM_LOAD_BALANCER_LOCATION}) ==="

# Patch the manifest to inject network name and LB location env vars before apply.
# HCCM reads HCLOUD_NETWORK and HCLOUD_LOAD_BALANCERS_LOCATION from the container env.
curl -sL "${MANIFEST_URL}" \
  | sed "s|HCLOUD_NETWORK_value|${HCCM_NETWORK}|g" \
  | kubectl apply -f -

# Patch env vars that the upstream manifest does not pre-populate
kubectl -n kube-system set env deployment/hcloud-cloud-controller-manager \
  HCLOUD_NETWORK="${HCCM_NETWORK}" \
  HCLOUD_LOAD_BALANCERS_LOCATION="${HCCM_LOAD_BALANCER_LOCATION}" \
  --overwrite

echo "=== hccm: waiting for controller deployment ==="
kubectl -n kube-system rollout status deployment/hcloud-cloud-controller-manager --timeout=120s

echo "=== hccm: removing node.cloudprovider.kubernetes.io/uninitialized taint from nodes ==="
kubectl get nodes -o name | while read -r node; do
  kubectl taint node "${node}" node.cloudprovider.kubernetes.io/uninitialized- 2>/dev/null || true
done

echo "=== hccm: ready (version=v${HCCM_VERSION}, network=${HCCM_NETWORK}, lb-location=${HCCM_LOAD_BALANCER_LOCATION}) ==="