#!/bin/bash

KUBECTL="/usr/local/bin/kubectl"

usage() {
    echo "Usage: $0 --user USERNAME [--role ROLE] [--delete]"
    exit 1
}

SERVICE_ACC_NAME=""
ROLE_NAME="view"
DELETE_IT=false

while [[ $# -gt 0 ]]; do
    case "$1" in
        --user)
            SERVICE_ACC_NAME="$2"
            shift 2
            ;;
        --role)
            ROLE_NAME="$2"
            shift 2
            ;;
        --delete)
            DELETE_IT=true
            shift
            ;;
        *)
            usage
            ;;
    esac
done

if [ -z "$SERVICE_ACC_NAME" ]; then
    usage
fi

if $DELETE_IT; then
    $KUBECTL delete serviceaccount "$SERVICE_ACC_NAME"
    $KUBECTL delete secret "$SERVICE_ACC_NAME-secret"
    $KUBECTL delete clusterrolebinding "view-$SERVICE_ACC_NAME-global"
    exit 0
fi

$KUBECTL create serviceaccount "$SERVICE_ACC_NAME" -n default -o json

cat <<EOF | $KUBECTL create -n default -o json -f -
apiVersion: v1
kind: Secret
metadata:
  name: $SERVICE_ACC_NAME-secret
  annotations:
    kubernetes.io/service-account.name: $SERVICE_ACC_NAME
type: kubernetes.io/service-account-token
EOF

SECRET_JSON=$($KUBECTL get secret "$SERVICE_ACC_NAME-secret" -o json)
CA_CRT=$(echo "$SECRET_JSON" | jq -r '.data["ca.crt"]')
USER_TOKEN=$(echo "$SECRET_JSON" | jq -r '.data.token | @base64d')

KUBECONFIG_JSON=$($KUBECTL config view --minify -o json)
CLUSTER_API=$(echo "$KUBECONFIG_JSON" | jq -r '.clusters[0].cluster.server')
CLUSTER_NAME=$(echo "$KUBECONFIG_JSON" | jq -r '.clusters[0].name')

cat <<EOF | $KUBECTL create -n default -o json -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: view-$SERVICE_ACC_NAME-global
subjects:
- kind: ServiceAccount
  name: $SERVICE_ACC_NAME
  namespace: default
roleRef:
  kind: ClusterRole
  name: $ROLE_NAME
  apiGroup: rbac.authorization.k8s.io
EOF

echo "## KUBECONFIG generated on $(date)"
cat <<EOF
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: $CA_CRT
    server: $CLUSTER_API
  name: $CLUSTER_NAME
contexts:
- context:
    cluster: $CLUSTER_NAME
    user: $SERVICE_ACC_NAME-$CLUSTER_NAME
  name: $CLUSTER_NAME
current-context: $CLUSTER_NAME
kind: Config
preferences: {}
users:
- name: $SERVICE_ACC_NAME-$CLUSTER_NAME
  user:
    token: $USER_TOKEN
EOF