#!/bin/bash
# Copyright 2016 The Kubernetes Authors All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -o errexit
set -o nounset
set -o pipefail

NODEUP_URL_AMD64=NUSourceAmd64
NODEUP_HASH_AMD64=NUSHashAmd64
NODEUP_URL_ARM64=NUSourceArm64
NODEUP_HASH_ARM64=NUSHashArm64

export AWS_REGION=eu-west-1


echo "http_proxy=http://example.com:80" >> /etc/environment
echo "https_proxy=http://example.com:80" >> /etc/environment
echo "no_proxy=" >> /etc/environment
echo "NO_PROXY=" >> /etc/environment
while read in; do export $in; done < /etc/environment
case `cat /proc/version` in
*[Dd]ebian*)
  echo "Acquire::http::Proxy \"${http_proxy}\";" > /etc/apt/apt.conf.d/30proxy ;;
*[Uu]buntu*)
  echo "Acquire::http::Proxy \"${http_proxy}\";" > /etc/apt/apt.conf.d/30proxy ;;
*[Rr]ed[Hh]at*)
  echo "proxy=${http_proxy}" >> /etc/yum.conf ;;
esac
echo "DefaultEnvironment=\"http_proxy=${http_proxy}\" \"https_proxy=${http_proxy}\" \"NO_PROXY=${no_proxy}\" \"no_proxy=${no_proxy}\"" >> /etc/systemd/system.conf
systemctl daemon-reload
systemctl daemon-reexec


function ensure-install-dir() {
  INSTALL_DIR="/opt/kops"
  # On ContainerOS, we install under /var/lib/toolbox; /opt is ro and noexec
  if [[ -d /var/lib/toolbox ]]; then
    INSTALL_DIR="/var/lib/toolbox/kops"
  fi
  mkdir -p ${INSTALL_DIR}/bin
  mkdir -p ${INSTALL_DIR}/conf
  cd ${INSTALL_DIR}
}

# Retry a download until we get it. args: name, sha, url1, url2...
download-or-bust() {
  local -r file="$1"
  local -r hash="$2"
  shift 2

  urls=( $* )
  while true; do
    for url in "${urls[@]}"; do
      commands=(
        "curl -f --ipv4 --compressed -Lo "${file}" --connect-timeout 20 --retry 6 --retry-delay 10"
        "wget --inet4-only --compression=auto -O "${file}" --connect-timeout=20 --tries=6 --wait=10"
        "curl -f --ipv4 -Lo "${file}" --connect-timeout 20 --retry 6 --retry-delay 10"
        "wget --inet4-only -O "${file}" --connect-timeout=20 --tries=6 --wait=10"
      )
      for cmd in "${commands[@]}"; do
        echo "Attempting download with: ${cmd} {url}"
        if ! (${cmd} "${url}"); then
          echo "== Download failed with ${cmd} =="
          continue
        fi
        if [[ -n "${hash}" ]] && ! validate-hash "${file}" "${hash}"; then
          echo "== Hash validation of ${url} failed. Retrying. =="
          rm -f "${file}"
        else
          if [[ -n "${hash}" ]]; then
            echo "== Downloaded ${url} (SHA1 = ${hash}) =="
          else
            echo "== Downloaded ${url} =="
          fi
          return
        fi
      done
    done

    echo "All downloads failed; sleeping before retrying"
    sleep 60
  done
}

validate-hash() {
  local -r file="$1"
  local -r expected="$2"
  local actual

  actual=$(sha256sum ${file} | awk '{ print $1 }') || true
  if [[ "${actual}" != "${expected}" ]]; then
    echo "== ${file} corrupted, hash ${actual} doesn't match expected ${expected} =="
    return 1
  fi
}

function split-commas() {
  echo $1 | tr "," "\n"
}

function try-download-release() {
  local -r nodeup_urls=( $(split-commas "${NODEUP_URL}") )
  if [[ -n "${NODEUP_HASH:-}" ]]; then
    local -r nodeup_hash="${NODEUP_HASH}"
  else
  # TODO: Remove?
    echo "Downloading sha256 (not found in env)"
    download-or-bust nodeup.sha256 "" "${nodeup_urls[@]/%/.sha256}"
    local -r nodeup_hash=$(cat nodeup.sha256)
  fi

  echo "Downloading nodeup (${nodeup_urls[@]})"
  download-or-bust nodeup "${nodeup_hash}" "${nodeup_urls[@]}"

  chmod +x nodeup
}

function download-release() {
  case "$(uname -m)" in
  x86_64*|i?86_64*|amd64*)
    NODEUP_URL="${NODEUP_URL_AMD64}"
    NODEUP_HASH="${NODEUP_HASH_AMD64}"
    ;;
  aarch64*|arm64*)
    NODEUP_URL="${NODEUP_URL_ARM64}"
    NODEUP_HASH="${NODEUP_HASH_ARM64}"
    ;;
  *)
    echo "Unsupported host arch: $(uname -m)" >&2
    exit 1
    ;;
  esac

  # In case of failure checking integrity of release, retry.
  cd ${INSTALL_DIR}/bin
  until try-download-release; do
    sleep 15
    echo "Couldn't download release. Retrying..."
  done

  echo "Running nodeup"
  # We can't run in the foreground because of https://github.com/docker/docker/issues/23793
  ( cd ${INSTALL_DIR}/bin; ./nodeup --install-systemd-unit --conf=${INSTALL_DIR}/conf/kube_env.yaml --v=8  )
}

####################################################################################

/bin/systemd-machine-id-setup || echo "failed to set up ensure machine-id configured"

echo "== nodeup node config starting =="
ensure-install-dir

cat > conf/cluster_spec.yaml << '__EOF_CLUSTER_SPEC'
cloudConfig:
  nodeTags: something
containerRuntime: docker
containerd:
  logLevel: info
docker:
  logLevel: INFO
encryptionConfig: null
etcdClusters:
  events:
    image: gcr.io/etcd-development/etcd:v3.1.11
    version: 3.1.11
  main:
    version: 3.1.11
fileAssets:
- content: E1oeAbrnQsSldrIP1BpoP2SDykM= (fingerprint)
  name: iptables-restore
  path: /var/lib/iptables/rules-save
hooks:
- execContainer:
    command:
    - pkF7ytM3ENpYWZF36FoHJsqXP5Y= (fingerprint)
    image: busybox
kubeAPIServer:
  image: CoreOS
kubeControllerManager:
  cloudProvider: aws
kubeProxy:
  cpuLimit: 30m
  cpuRequest: 30m
  featureGates:
    AdvancedAuditing: "true"
  memoryLimit: 30Mi
  memoryRequest: 30Mi
kubeScheduler:
  image: SomeImage
kubelet:
  kubeconfigPath: /etc/kubernetes/config.txt
masterKubelet:
  kubeconfigPath: /etc/kubernetes/config.cfg

__EOF_CLUSTER_SPEC

cat > conf/ig_spec.yaml << '__EOF_IG_SPEC'
fileAssets:
- content: E1oeAbrnQsSldrIP1BpoP2SDykM= (fingerprint)
  name: iptables-restore
  path: /var/lib/iptables/rules-save
- content: xYagtQLwBAAi3V8Wc2Jrojz28I0= (fingerprint)
  name: tokens
  path: /kube/tokens.csv
hooks:
- before:
  - update-engine.service
  - kubelet.service
  manifest: /uSPh015xYXh8dAVqXjP/ePkbrM= (fingerprint)
  name: disable-update-engine.service
- manifest: 8BN3anFUyDlkVF/JnaJqbwpq8ME= (fingerprint)
  name: apply-to-all.service

__EOF_IG_SPEC

cat > conf/kube_env.yaml << '__EOF_KUBE_ENV'
InstanceGroupRole: Master
KubeletConfig:
  kubeconfigPath: /etc/kubernetes/igconfig.txt
  nodeLabels:
    kubernetes.io/role: master
    label2: value2
    labelname: labelvalue
    node-role.kubernetes.io/master: ""
  taints:
  - key1=value1:NoSchedule
  - key2=value2:NoExecute

__EOF_KUBE_ENV

download-release
echo "== nodeup node config done =="
