#!/bin/bash
rg="jc-testing5-aks-rg"
location="francecentral"
cluster="jc-aks-testing5-cluster"
keyvaultname="jc-aks-testing5-kv"

## Create RG
echo "Creating Resource Group $rg"
az group create --name $rg --location $location

## Create AKS Cluster
echo "Creating AKS Cluster $cluster"

az aks create -g $rg -n $cluster --load-balancer-managed-outbound-ip-count 1 --enable-managed-identity --node-vm-size Standard_B2s --node-count 1 --generate-ssh-keys

## Create KeyVault
echo "Creating KeyVault $keyvaultname"
az key vault create --resource-group $rg --name $keyvaultname

## Connect to Cluster
echo "Connecting to AKS Cluster."
az aks get-credentials --resource-group $rg --name $cluster --overwrite-existing

## Install Nginx
echo "Installing Nginx into the cluster"
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

helm install nginx-ingress ingress-nginx/ingress-nginx 
    --namespace ingress-nginx --create-namespace
    --set controller.replicaCount=2 
    --set controller.nodeSelector."kubernetes.io/os"=linux 
    --set controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os"=linux 
    --set defaultBackend.nodeSelector."kubernetes.io/os"=linux

#CERT_MANAGER_TAG=v1.3.1
CERT_MANAGER_TAG=v1.13.6

# Label the ingress-basic namespace to disable resource validation
kubectl label namespace ingress-nginx cert-manager.io/disable-validation=true

# Add the Jetstack Helm repository in preparation to install Cert-Manager
echo "Installing Cert-Manager"
helm repo add jetstack https://charts.jetstack.io --force-update

# Update your local Helm chart repository cache
helm repo update

# Install the cert-manager Helm chart
helm install cert-manager jetstack/cert-manager 
  --namespace ingress-nginx 
  --version $CERT_MANAGER_TAG 
  --set installCRDs=true 
  --set nodeSelector."kubernetes.io/os"=linux

## Create a Cert-Cluster Issuer.
echo "Creating Certmanger Cluster Issuer for ArgoCD"

cat << EOF | kubectl apply -f - 
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-key-secret
  namespace: ingress-nginx
type: Opaque
Data:
  api-key: MYVALUE
EOF

cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: letsencrypt
  namespace: ingress-nginx
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    solvers:
    - dns01:
        cloudflare:
          apiKeySecretRef:
            key: api-key
            name: cloudflare-api-key-secret
          email: [email protected]
EOF


cat << EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: jc-aks-testing-cert
  namespace: ingress-nginx
spec:
  secretName: mydomain.com-tls
  issuerRef:
    name: letsencrypt

  duration: 2160h # 90d
  renewBefore: 720h # 30d before SSL will expire, renew it
  dnsNames:
    - "mydomain.com"
    - "mydomain.com"
EOF

## Install Argo CD
echo "Installing Argo CD"
kubectl create namespace argocd

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

## Configure Argo CD to Look at Custom Domain
echo "Configuring Argo CD to Look at Custom Domain"
cat << EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-ingress
  namespace: argocd
  annotations:
    cert-manager.io/issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    # If you encounter a redirect loop or are getting a 307 response code
    # then you need to force the nginx ingress to connect to the backend using HTTPS.
    #
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  rules:
  - host: mydomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: argocd-server
            port:
              name: https
  tls:
  - hosts:
    - mydomain.com
    secretName: argocd-secret # do not change, this is provided by Argo CD
EOF


## Get the Password for Argo CD Login
echo "Getting the Password to login into Argo-CD"
argo_cd_pass=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
echo "$argo_cd_pass"