#!/bin/sh

set -eu

CILIUM_VERSION=v1.20.0
NAMESPACE=kube-system
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

for command in cilium-cli kubectl; do
    if ! command -v "$command" >/dev/null 2>&1; then
        echo "Required command not found: $command" >&2
        exit 1
    fi
done

kubectl apply --dry-run=server --validate=false \
  --filename "$SCRIPT_DIR/hubble-pki.yaml"
kubectl apply --validate=false --filename "$SCRIPT_DIR/hubble-pki.yaml"

kubectl wait --for=condition=Ready issuer/hubble-selfsigned \
  --namespace "$NAMESPACE" --timeout=2m
kubectl wait --for=condition=Ready certificate/hubble-ca \
  --namespace "$NAMESPACE" --timeout=5m
kubectl wait --for=condition=Ready issuer/hubble-ca \
  --namespace "$NAMESPACE" --timeout=2m

existing_installation=false
version_change=false
if kubectl get daemonset/cilium --namespace "$NAMESPACE" >/dev/null 2>&1; then
    existing_installation=true
    current_image=$(kubectl get daemonset/cilium --namespace "$NAMESPACE" \
      --output=jsonpath='{.spec.template.spec.containers[0].image}')
    case "$current_image" in
        *":$CILIUM_VERSION"|*":$CILIUM_VERSION@"*) ;;
        *) version_change=true ;;
    esac

    cilium-cli upgrade \
      --version "$CILIUM_VERSION" \
      --reset-values \
      --values "$SCRIPT_DIR/values.yaml"
else
    cilium-cli install \
      --version "$CILIUM_VERSION" \
      --values "$SCRIPT_DIR/values.yaml" \
      --wait
fi

kubectl wait --for=condition=Ready certificate/hubble-server-certs \
  --namespace "$NAMESPACE" --timeout=5m
kubectl wait --for=condition=Ready certificate/hubble-relay-client-certs \
  --namespace "$NAMESPACE" --timeout=5m

# A version upgrade already changes the Pod templates. Wait for those rolling
# updates instead of forcing a second restart. A same-version reconcile still
# restarts the agents and Relay so renewed Hubble certificates are loaded.
if [ "$existing_installation" = true ]; then
    if [ "$version_change" = false ]; then
        kubectl rollout restart daemonset/cilium --namespace "$NAMESPACE"
    fi
    kubectl rollout status daemonset/cilium \
      --namespace "$NAMESPACE" --timeout=10m
    kubectl rollout status daemonset/cilium-envoy \
      --namespace "$NAMESPACE" --timeout=10m
    kubectl rollout status deployment/cilium-operator \
      --namespace "$NAMESPACE" --timeout=10m
fi

if [ "$version_change" = false ]; then
    kubectl rollout restart deployment/hubble-relay --namespace "$NAMESPACE"
fi
kubectl rollout status deployment/hubble-relay \
  --namespace "$NAMESPACE" --timeout=5m

cilium-cli status --wait

# Install availability alerts when Prometheus Operator is present. This keeps
# a fresh Cilium-only bootstrap independent from the monitoring install order.
if kubectl get customresourcedefinition prometheusrules.monitoring.coreos.com >/dev/null 2>&1; then
    kubectl apply --filename "$SCRIPT_DIR/cilium-alerts.yaml"
fi