---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-bootstrap-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8s-bootstrap-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: k8s-bootstrap-admin
    namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-bootstrap-config
  namespace: kube-system
data:
  HOME: /tmp/cluster-home
  SSH_CONFIG: |
    StrictHostKeyChecking no
    LogLevel VERBOSE
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-bootstrap-scripts
  namespace: kube-system
data:
  clone-start-of-day: |
    #!/bin/sh
    set -ex
    # FIXME: don't hard-code this.
    rm -rf /tmp/git-storage/k8s-start-of-day
    git clone --recurse-submodules git@gitlab.brainfood.com:brainfood/k8s-start-of-day.git /tmp/git-storage/k8s-start-of-day
    cd /tmp/git-storage/k8s-start-of-day
    if [ -e helmfile.yaml ]; then
      echo helmfile > /tmp/git-storage/repo-type
    elif [ -e kustomization.yaml ]; then
      echo kustomize > /tmp/git-storage/repo-type
    else
      echo unknown > /tmp/git-storage/repo-type
    fi
  check-mode: |
    #!/bin/sh
    set -ex
    wanted_type="$1"
    if [ $(cat /tmp/git-storage/repo-type) = $wanted_type ]; then
      shift
      /tmp/k8s-bootstrap-scripts/run-$wanted_type "$@"
    fi
  run-helmfile: |
    #!/bin/sh
    set -ex
    mkdir -p $HOME/.config/kustomize/plugin
    helm plugin install https://github.com/mumoshu/helm-x
    helm plugin install https://github.com/databus23/helm-diff
    helm plugin install https://github.com/aslafy-z/helm-git.git
    "$@"

---
apiVersion: batch/v1
kind: Job
metadata:
  name: k8s-bootstrap
  namespace: kube-system
spec:
  template:
    spec:
      restartPolicy: OnFailure
      securityContext:
        runAsUser: 1234
        runAsGroup: 1234
        fsGroup: 1234

      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master

      serviceAccountName: k8s-bootstrap-admin

      volumes:
        - name: k8s-bootstrap-ssh-config
          configMap:
            name: k8s-bootstrap-config
            defaultMode: 0600
            items:
              - key: SSH_CONFIG
                path: config

        - name: k8s-bootstrap-ssh-auth
          secret:
            secretName: cluster-ssh
            defaultMode: 0600
            items:
              - key: ssh-private-key
                path: id_rsa

        - name: k8s-bootstrap-scripts
          configMap:
            name: k8s-bootstrap-scripts
            defaultMode: 0755
        - name: cluster-home
          emptyDir: {}
        - name: cluster-ssh
          emptyDir: {}
        - name: git-storage
          emptyDir: {}

      initContainers:
        - name: clone-k8s-start-of-day
          image: bitnami/git
          envFrom:
            - configMapRef:
                name: k8s-bootstrap-config
          volumeMounts:
            - name: k8s-bootstrap-scripts
              mountPath: /tmp/k8s-bootstrap-scripts
            - name: cluster-home
              mountPath: /tmp/cluster-home
            - name: cluster-ssh
              mountPath: /tmp/cluster-home/.ssh
            - name: k8s-bootstrap-ssh-auth
              mountPath: /tmp/cluster-home/.ssh/id_rsa
              subPath: id_rsa
            - name: k8s-bootstrap-ssh-config
              mountPath: /tmp/cluster-home/.ssh/config
              subPath: config
            - name: git-storage
              mountPath: /tmp/git-storage
          command: ["/tmp/k8s-bootstrap-scripts/clone-start-of-day"]

        - name: try-helmfile
          image: quay.io/roboll/helmfile:v0.143.5-stable-slim
          workingDir: /tmp/git-storage/k8s-start-of-day
          command: ["/tmp/k8s-bootstrap-scripts/check-mode", "helmfile", "/usr/local/bin/helmfile"]
          args: ["apply"]
          envFrom:
            - configMapRef:
                name: k8s-bootstrap-config
          volumeMounts:
            - name: git-storage
              mountPath: /tmp/git-storage
            - name: k8s-bootstrap-scripts
              mountPath: /tmp/k8s-bootstrap-scripts
            - name: cluster-home
              mountPath: /tmp/cluster-home
            - name: cluster-ssh
              mountPath: /tmp/cluster-home/.ssh
            - name: k8s-bootstrap-ssh-auth
              mountPath: /tmp/cluster-home/.ssh/id_rsa
              subPath: id_rsa
            - name: k8s-bootstrap-ssh-config
              mountPath: /tmp/cluster-home/.ssh/config
              subPath: config

      containers:
        - name: show-status
          image: bash
          command: ["bash", "-exc", "ls -Ral /tmp"]
          volumeMounts:
            - name: git-storage
              mountPath: /tmp/git-storage
---