#!/bin/sh

set -eu

chart_version=${DASHBOARD_CHART_VERSION:-7.14.0}
project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
chart_archive=$(mktemp)
helm_cache=$(mktemp -d)
trap 'rm -f "$chart_archive"; rm -rf "$helm_cache"' EXIT HUP INT TERM

for command in curl helm kubectl; do
  if ! command -v "$command" >/dev/null 2>&1; then
    echo "Required command not found: $command" >&2
    exit 1
  fi
done

kubectl create namespace kubernetes-dashboard --dry-run=client --output=yaml \
  | kubectl apply --filename=-

# This privileged identity is deliberately bootstrap-only. CI cannot edit the
# cluster-admin binding, and no long-lived service-account token is created.
kubectl apply --filename "$project_dir/kubernetes-dashboard-user.yaml"

curl --fail --silent --show-error --location --output "$chart_archive" \
  "https://github.com/kubernetes-retired/dashboard/releases/download/kubernetes-dashboard-${chart_version}/kubernetes-dashboard-${chart_version}.tgz"

HELM_CACHE_HOME="$helm_cache" HELM_PLUGINS="$project_dir/helm-plugins" \
helm upgrade --install kubernetes-dashboard "$chart_archive" \
  --namespace kubernetes-dashboard \
  --values "$project_dir/kubernetes-dashboard-values.yaml" \
  --server-side=true --take-ownership --force-conflicts --rollback-on-failure \
  --wait --timeout 15m

kubectl apply --filename "$project_dir/auth-proxy.yaml"
kubectl apply --filename "$project_dir/kubernetes-dashboard-ingressroute.yaml"

for deployment in \
  kubernetes-dashboard-api \
  kubernetes-dashboard-auth \
  kubernetes-dashboard-web \
  kubernetes-dashboard-metrics-scraper \
  kubernetes-dashboard-kong \
  kubernetes-dashboard-auth-proxy
do
  kubectl --namespace kubernetes-dashboard rollout status \
    "deployment/$deployment" --timeout=10m
done