#!/usr/bin/env bash
set -euo pipefail

ADMIN_KUBECONFIG="${KUBECONFIG:-${KUBECONFIG_PATH:-${HOME}/.kube/config}}"
READONLY_NAMESPACE="${READONLY_NAMESPACE:-homelab-access}"
READONLY_SERVICE_ACCOUNT="${READONLY_SERVICE_ACCOUNT:-homelab-readonly}"
READONLY_KUBECONFIG="${READONLY_KUBECONFIG:-${HOME}/.kube/homelab-readonly.conf}"
READONLY_TOKEN_DURATION="${READONLY_TOKEN_DURATION:-24h}"

usage() {
    cat <<'EOF'
Usage: scripts/kubeconfig-readonly

Generate a separate read-only kubeconfig from the repo-managed
homelab-access/homelab-readonly ServiceAccount.
EOF
}

require_kubectl() {
    if ! command -v kubectl >/dev/null 2>&1; then
        echo "kubectl is required." >&2
        exit 1
    fi
    if [[ ! -s "${ADMIN_KUBECONFIG}" ]]; then
        echo "admin kubeconfig missing: ${ADMIN_KUBECONFIG}" >&2
        exit 1
    fi
}

main() {
    local server
    local cluster_name
    local ca_data
    local token
    local user_name="homelab-readonly"
    local context_name="homelab-readonly"

    case "${1:-}" in
        -h | --help | help)
            usage
            return 0
            ;;
    esac

    require_kubectl

    kubectl --kubeconfig "${ADMIN_KUBECONFIG}" -n "${READONLY_NAMESPACE}" get serviceaccount "${READONLY_SERVICE_ACCOUNT}" >/dev/null
    token="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" -n "${READONLY_NAMESPACE}" create token "${READONLY_SERVICE_ACCOUNT}" --duration="${READONLY_TOKEN_DURATION}")"
    server="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
    cluster_name="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --minify -o jsonpath='{.clusters[0].name}')"
    ca_data="$(kubectl --kubeconfig "${ADMIN_KUBECONFIG}" config view --raw --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')"

    mkdir -p "$(dirname "${READONLY_KUBECONFIG}")"
    umask 077
    cat >"${READONLY_KUBECONFIG}" <<EOF
apiVersion: v1
kind: Config
clusters:
  - name: ${cluster_name}
    cluster:
      server: ${server}
      certificate-authority-data: ${ca_data}
users:
  - name: ${user_name}
    user:
      token: ${token}
contexts:
  - name: ${context_name}
    context:
      cluster: ${cluster_name}
      user: ${user_name}
      namespace: default
current-context: ${context_name}
EOF
    chmod 0600 "${READONLY_KUBECONFIG}"

    echo "Created read-only kubeconfig: ${READONLY_KUBECONFIG}"
    echo "Test with:"
    echo "  KUBECONFIG=${READONLY_KUBECONFIG} kubectl get pods -A"
}

main "$@"