#!/usr/bin/env bash
# Refresh the local kubeconfig entry for prole-k3s using the live kubeconfig
# from myrddin.prole.org. The CA bundle on the server is malformed, so we
# deliberately disable TLS verification while keeping client cert auth.

# If invoked via `sh`, re-exec with bash to enable arrays and pipefail.
if [ -z "${BASH_VERSION:-}" ]; then
  exec bash "$0" "$@"
fi

set -euo pipefail

SERVER=${K3S_SERVER:-"https://myrddin.prole.org:6443"}
REMOTE_HOST=${K3S_REMOTE_HOST:-"myrddin.prole.org"}
REMOTE_USER=${K3S_REMOTE_USER:-"ansible"}
SSH_KEY=${K3S_SSH_KEY:-"$HOME/.ssh/id_ed25519_ansible"}
REMOTE_KUBECONFIG=${K3S_REMOTE_KUBECONFIG:-"/etc/rancher/k3s/k3s.yaml"}

CLUSTER="prole-k3s"
USER="prole-k3s"
CONTEXT="prole-k3s"

echo "Configuring ${CONTEXT} from ${REMOTE_HOST}..."

if ! command -v kubectl >/dev/null 2>&1; then
  echo "[error] kubectl not found in PATH" >&2
  exit 1
fi

TMP_REMOTE=$(mktemp)
TMP_CERT=$(mktemp)
TMP_KEY=$(mktemp)

# Fetch kubeconfig from the control-plane node (requires ssh access).
if ! ssh -i "${SSH_KEY}" "${REMOTE_USER}@${REMOTE_HOST}" sudo cat "${REMOTE_KUBECONFIG}" >"${TMP_REMOTE}"; then
  echo "[error] unable to fetch kubeconfig from ${REMOTE_HOST}" >&2
  rm -f "${TMP_REMOTE}" "${TMP_CERT}" "${TMP_KEY}"
  exit 1
fi

# Extract client cert/key data from the remote kubeconfig into temp files.
python - "$TMP_REMOTE" "$TMP_CERT" "$TMP_KEY" <<'PY'
import sys, base64, yaml
src, cert_path, key_path = sys.argv[1:]
cfg = yaml.safe_load(open(src))
user = cfg['users'][0]['user']
base64.b64decode(user['client-certificate-data'], validate=True, altchars=None)
base64.b64decode(user['client-key-data'], validate=True, altchars=None)
open(cert_path, 'wb').write(base64.b64decode(user['client-certificate-data']))
open(key_path, 'wb').write(base64.b64decode(user['client-key-data']))
PY

# Configure cluster entry (skip CA because the server CA is malformed).
kubectl config set-cluster "${CLUSTER}" \
  --server="${SERVER}" \
  --insecure-skip-tls-verify=true >/dev/null
kubectl config unset "clusters.${CLUSTER}.certificate-authority" >/dev/null 2>&1 || true
kubectl config unset "clusters.${CLUSTER}.certificate-authority-data" >/dev/null 2>&1 || true

kubectl config set-credentials "${USER}" \
  --client-certificate="${TMP_CERT}" \
  --client-key="${TMP_KEY}" \
  --embed-certs=true >/dev/null

kubectl config set-context "${CONTEXT}" \
  --cluster="${CLUSTER}" \
  --user="${USER}" \
  --namespace=default >/dev/null

kubectl config use-context "${CONTEXT}" >/dev/null

rm -f "${TMP_REMOTE}" "${TMP_CERT}" "${TMP_KEY}"

echo "Done. Context ${CONTEXT} is ready."
kubectl --context "${CONTEXT}" auth whoami