#!/usr/bin/env bash
# Route registry.abrban.com pulls to harbor-core (HTTP) for proxy-cache support.
set -euo pipefail

NS="${NS:-kube-system}"
NODE="${NODE:-abr}"
HARBOR_CORE_IP="${HARBOR_CORE_IP:-$(kubectl -n cloudhost get svc harbor-core -o jsonpath='{.spec.clusterIP}')}"
REG_USER="${REG_USER:-harbor_registry_user}"
REG_PASS="${REG_PASS:-$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)}"

REG_PASS_B64="$(printf '%s' "$REG_PASS" | base64 | tr -d '\n')"

kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found

kubectl -n "${NS}" create secret generic k3s-registries-setup-env \
  --from-literal=HARBOR_CORE_IP="${HARBOR_CORE_IP}" \
  --from-literal=REG_USER="${REG_USER}" \
  --from-literal=REG_PASS_B64="${REG_PASS_B64}" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n "${NS}" delete pod k3s-registries-setup --ignore-not-found

kubectl -n "${NS}" run k3s-registries-setup \
  --image=rancher/mirrored-library-busybox:1.36.1 \
  --restart=Never \
  --overrides="$(cat <<EOF
{
  "apiVersion": "v1",
  "spec": {
    "nodeName": "${NODE}",
    "hostNetwork": true,
    "containers": [{
      "name": "setup",
      "image": "rancher/mirrored-library-busybox:1.36.1",
      "securityContext": {"privileged": true},
      "envFrom": [{"secretRef": {"name": "k3s-registries-setup-env"}}],
      "command": ["sh", "-ec", "REG_PASS=\$(echo \"\$REG_PASS_B64\" | base64 -d); mkdir -p /host/etc/rancher/k3s && cat > /host/etc/rancher/k3s/registries.yaml <<REGEOF\nmirrors:\n  registry.abrban.com:\n    endpoint:\n      - http://\${HARBOR_CORE_IP}\n  \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n    endpoint:\n      - \\\"http://127.0.0.1:30500\\\"\nconfigs:\n  registry.abrban.com:\n    auth:\n      username: \${REG_USER}\n      password: \${REG_PASS}\n  \\\"\${HARBOR_CORE_IP}\\\":\n    auth:\n      username: \${REG_USER}\n      password: \${REG_PASS}\n  \\\"registry.cloudhost-builds.svc.cluster.local:5000\\\":\n    auth:\n      username: admin\n      password: \\\"\\\"\n  \\\"127.0.0.1:30500\\\":\n    auth:\n      username: admin\n      password: \\\"\\\"\nREGEOF\nnsenter -t 1 -m -u -n -i -- systemctl restart k3s 2>/dev/null || true\necho k3s-restarted\nsleep 30"],
      "volumeMounts": [{"name": "host", "mountPath": "/host"}]
    }],
    "volumes": [{"name": "host", "hostPath": {"path": "/"}}]
  }
}
EOF
)"

kubectl -n "${NS}" wait --for=condition=Ready pod/k3s-registries-setup --timeout=180s || true
kubectl -n "${NS}" logs k3s-registries-setup