#!/usr/bin/env bash
set -euo pipefail

namespace="blackshield-policy"
service="blackshield-policy-admission"
image="public.ecr.aws/blackshield-security/policy-client:1.0.12"
tmp_dir="$(mktemp -d)"
trap 'rm -r -- "$tmp_dir"' EXIT
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -subj "/CN=${service}.${namespace}.svc" \
  -addext "subjectAltName=DNS:${service}.${namespace}.svc" \
  -keyout "$tmp_dir/tls.key" -out "$tmp_dir/tls.crt" >/dev/null 2>&1
kubectl -n "$namespace" create secret tls blackshield-policy-tls \
  --cert="$tmp_dir/tls.crt" --key="$tmp_dir/tls.key" \
  --dry-run=client -o yaml | kubectl apply -f -
ca_bundle="$(base64 -w 0 <"$tmp_dir/tls.crt")"

sed "s|__CA_BUNDLE__|$ca_bundle|g; s|__IMAGE__|$image|g" <<'YAML' | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata: {name: blackshield-policy-admission, namespace: blackshield-policy}
spec:
  replicas: 2
  selector: {matchLabels: {app: blackshield-policy-admission}}
  template:
    metadata: {labels: {app: blackshield-policy-admission}}
    spec:
      containers:
        - name: proxy
          image: __IMAGE__
          env:
            - {name: POLICY_CLIENT_MODE, value: admission_proxy}
            - {name: POLICY_PROXY_TLS_CERT, value: /tls/tls.crt}
            - {name: POLICY_PROXY_TLS_KEY, value: /tls/tls.key}
          envFrom:
            - secretRef: {name: blackshield-policy-client}
          ports: [{name: https, containerPort: 8080}]
          readinessProbe: {httpGet: {path: /health, port: https, scheme: HTTPS}}
          resources: {requests: {cpu: 50m, memory: 64Mi}, limits: {cpu: 500m, memory: 256Mi}}
          volumeMounts: [{name: tls, mountPath: /tls, readOnly: true}]
      volumes: [{name: tls, secret: {secretName: blackshield-policy-tls}}]
---
apiVersion: v1
kind: Service
metadata: {name: blackshield-policy-admission, namespace: blackshield-policy}
spec: {selector: {app: blackshield-policy-admission}, ports: [{port: 443, targetPort: https}]}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata: {name: blackshield-policy-admission}
webhooks:
  - name: policies.blackshield.chaplau.com
    admissionReviewVersions: [v1]
    sideEffects: None
    timeoutSeconds: 10
    failurePolicy: Ignore
    clientConfig:
      service: {name: blackshield-policy-admission, namespace: blackshield-policy, path: /validate, port: 443}
      caBundle: __CA_BUNDLE__
    rules:
      - apiGroups: ["apps", "batch", ""]
        apiVersions: [v1]
        operations: [CREATE, UPDATE]
        resources: [deployments, statefulsets, daemonsets, jobs, cronjobs, pods]
YAML

echo "BlackShield Kubernetes admission proxy installed with immutable policy-client:1.0.12."