#!/usr/bin/env bash
# Control-plane bootstrap (Terraform design 7.2). Run ONCE on the CP as root after cloud-init finished:
#   sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/init-cp.sh
# Re-running is safe: kubeadm init is skipped when /etc/kubernetes/admin.conf exists; the rest is idempotent apply.
set -euo pipefail
FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}"   # https://github.com/flannel-io/flannel/releases
ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.3}"       # https://github.com/argoproj/argo-cd/releases
GITOPS_DIR="${GITOPS_DIR:-/opt/selfheal/gitops}"
# shellcheck disable=SC1091
. /opt/selfheal/node.env   # ROLE, POD_CIDR, CP_PRIVATE_IP, CP_PUBLIC_IP (written by cloud-init)
[ "$ROLE" = cp ] || { echo "not a control plane node (ROLE=$ROLE)" >&2; exit 1; }

if [ ! -f /etc/kubernetes/admin.conf ]; then
  # advertise on the private IP (VPN peers and workers reach it); the EIP goes into the API server cert SANs
  kubeadm init \
    --pod-network-cidr="$POD_CIDR" \
    --apiserver-advertise-address="$CP_PRIVATE_IP" \
    --apiserver-cert-extra-sans="$CP_PUBLIC_IP" \
    --node-name "$(hostname)"
fi
export KUBECONFIG=/etc/kubernetes/admin.conf
install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.kube
install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube/config

# CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8)
kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"

# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
kubectl -n argocd rollout status deploy/argocd-server --timeout=600s
kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"

# Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh
kubeadm token create --print-join-command > /opt/selfheal/join.sh
chmod 600 /opt/selfheal/join.sh
echo "control plane ready; join command in /opt/selfheal/join.sh"