setup.sh

# Copyright Contributors to the Open Cluster Management project


#!/usr/bin/env bash

source ./port-defaults.sh
source ./oauth-client-name.sh

echo > ./backend/.env

echo PORT="${BACKEND_PORT}" >> ./backend/.env
echo NODE_ENV=development >> ./backend/.env

CLUSTER_API_URL=`oc get infrastructure cluster -o jsonpath={.status.apiServerURL}`
echo CLUSTER_API_URL=$CLUSTER_API_URL >> ./backend/.env

OAUTH2_REDIRECT_URL=https://localhost:${FRONTEND_PORT}/multicloud/login/callback
echo OAUTH2_REDIRECT_URL=$OAUTH2_REDIRECT_URL >> ./backend/.env

FRONTEND_URL=https://localhost:${FRONTEND_PORT}
echo FRONTEND_URL=$FRONTEND_URL >> ./backend/.env

INSTALLATION_NAMESPACE=`oc get multiclusterhub -A -o jsonpath='{.items[0].metadata.namespace}' || true`
INSTALLATION_NAMESPACE_MCE=`oc get multiclusterengine -A -o jsonpath='{.items[0].spec.targetNamespace}'`

# Look up or create service account token secret for multicluster-engine console-mce ServiceAccount
SA=$(oc get serviceaccounts -n $INSTALLATION_NAMESPACE_MCE console-mce -o jsonpath='{.metadata.name}')
SA_SECRET=$(oc get secrets -n $INSTALLATION_NAMESPACE_MCE -o json | jq -r "[.items[] | select(.metadata.annotations[\"kubernetes.io/service-account.name\"] == \"$SA\" and .type == \"kubernetes.io/service-account-token\")][0].metadata.name // \"\"")
if [[ -z "$SA_SECRET" ]]; then
  oc apply -f - << EOF
apiVersion: v1
kind: Secret
metadata:
  name: console-mce-token
  namespace: $INSTALLATION_NAMESPACE_MCE
  annotations:
    kubernetes.io/service-account.name: $SA 
type: kubernetes.io/service-account-token 
EOF
  SA_SECRET="console-mce-token"
fi

SA_TOKEN=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.token}" | base64 -d`
CA_CERT=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.ca\.crt}"`
SERVICE_CA_CERT=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.service-ca\.crt}"`

echo TOKEN=$SA_TOKEN >> ./backend/.env
echo CA_CERT=$CA_CERT >> ./backend/.env
echo SERVICE_CA_CERT=$SERVICE_CA_CERT >> ./backend/.env

# Look up or create service account token secret for openshift-console console ServiceAccount
CONSOLE_SA="console"
CONSOLE_SA_SECRET=$(oc get secrets -n openshift-console -o json | jq -r "[.items[] | select(.metadata.annotations[\"kubernetes.io/service-account.name\"] == \"$CONSOLE_SA\" and .type == \"kubernetes.io/service-account-token\")][0].metadata.name // \"\"")
if [[ -z "$CONSOLE_SA_SECRET" ]]; then
  oc apply -f - << EOF
apiVersion: v1
kind: Secret
metadata:
  name: off-cluster-token
  namespace: openshift-console
  annotations:
    kubernetes.io/service-account.name: $CONSOLE_SA 
type: kubernetes.io/service-account-token 
EOF
  CONSOLE_SA_SECRET="off-cluster-token"
fi

if [[ "$AUTH" == "oidc" ]]; then
  OIDC_PROVIDER=$(oc get authentication cluster -o json | jq '.spec.oidcProviders[0]')
  OIDC_CLIENT=$(echo "$OIDC_PROVIDER" | jq '[.oidcClients[] | select(.clientSecret != null)][0]')
  OAUTH2_CLIENT_ID=$(echo "$OIDC_CLIENT" | jq -r '.clientID')
  OIDC_CLIENT_SECRET_NAME=$(echo "$OIDC_CLIENT" | jq -r '.clientSecret.name')
  OAUTH2_CLIENT_SECRET=$(oc get secret "$OIDC_CLIENT_SECRET_NAME" -n openshift-config -o jsonpath='{.data.clientSecret}' | base64 -d)
  OIDC_ISSUER_URL=$(echo "$OIDC_PROVIDER" | jq -r '.issuer.issuerURL')
  echo OAUTH2_CLIENT_ID=$OAUTH2_CLIENT_ID >> ./backend/.env
  echo OAUTH2_CLIENT_SECRET=$OAUTH2_CLIENT_SECRET >> ./backend/.env
  echo OIDC_ISSUER_URL=$OIDC_ISSUER_URL >> ./backend/.env
else
  echo OAUTH2_CLIENT_ID=$OAUTH_CLIENT_NAME >> ./backend/.env

  # Create or update OAuthClient
  REDIRECT_URL=http://localhost:${CONSOLE_PORT}/auth/callback
  REDIRECT_URL_STANDALONE=$OAUTH2_REDIRECT_URL

  if ! oc get OAuthClient $OAUTH_CLIENT_NAME &> /dev/null; then
    oc process -f -  << EOF | oc apply -f -
apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: console-oauth-client
parameters:
  - name: OAUTH_SECRET
    generate: expression
    from: "[a-zA-Z0-9]{40}"
objects:
  - apiVersion: oauth.openshift.io/v1
    kind: OAuthClient
    metadata:
      name: ${OAUTH_CLIENT_NAME}
    grantMethod: auto
    secret: \${OAUTH_SECRET}
    redirectURIs:
    - ${REDIRECT_URL}
    - ${REDIRECT_URL_STANDALONE}
EOF
  else
    REDIRECT_URIS=$(oc get OAuthClient $OAUTH_CLIENT_NAME -o json | jq -c "[.redirectURIs[], \"$REDIRECT_URL\", \"$REDIRECT_URL_STANDALONE\"] | unique")
    oc patch OAuthClient $OAUTH_CLIENT_NAME --type json -p "[{\"op\": \"add\", \"path\": \"/redirectURIs\", \"value\": ${REDIRECT_URIS}}]"
  fi

  printf "OAUTH2_CLIENT_SECRET=" >> ./backend/.env
  oc get OAuthClient $OAUTH_CLIENT_NAME -o jsonpath='{.secret}{"\n"}' >> ./backend/.env
fi

# Create route to the search-api service on the target cluster.
if [[ -n "$INSTALLATION_NAMESPACE" ]]; then
  oc apply -f - << EOF
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: search-api
  namespace: $INSTALLATION_NAMESPACE
spec:
  to:
    kind: Service
    name: search-search-api
  tls:
    termination: reencrypt
    insecureEdgeTerminationPolicy: Redirect
EOF
  SEARCH_API_URL=https://$(oc get route search-api -n $INSTALLATION_NAMESPACE -o="jsonpath={.status.ingress[0].host}")
  echo SEARCH_API_URL=$SEARCH_API_URL >> ./backend/.env
fi

# Create NetworkPolicy to allow access to the search-api service.
if [[ -n "$INSTALLATION_NAMESPACE" ]]; then
  oc apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: search-api-localdev-route-access
  namespace: $INSTALLATION_NAMESPACE
spec:
  podSelector:
    matchLabels:
      name: search-api
  policyTypes:
    - Ingress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: openshift-ingress
      ports:
      - port: 4010
        protocol: TCP
EOF
fi

# Create route to the placement debug service for local development.
oc apply -f - << EOF
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: cluster-manager-placement
  namespace: open-cluster-management-hub
spec:
  to:
    kind: Service
    name: cluster-manager-placement
  tls:
    termination: reencrypt
    insecureEdgeTerminationPolicy: Redirect
EOF
PLACEMENT_DEBUG_URL=https://$(oc get route cluster-manager-placement -n open-cluster-management-hub -o="jsonpath={.status.ingress[0].host}")/debug/placements/
echo PLACEMENT_DEBUG_URL=$PLACEMENT_DEBUG_URL >> ./backend/.env

CLUSTER_PROXY_ADDON_USER_HOST=$(oc get route cluster-proxy-addon-user -n $INSTALLATION_NAMESPACE_MCE -o="jsonpath={.status.ingress[0].host}")
echo CLUSTER_PROXY_ADDON_USER_HOST=$CLUSTER_PROXY_ADDON_USER_HOST >> ./backend/.env
CLUSTER_PROXY_ADDON_USER_ROUTE=https://$CLUSTER_PROXY_ADDON_USER_HOST
echo CLUSTER_PROXY_ADDON_USER_ROUTE=$CLUSTER_PROXY_ADDON_USER_ROUTE >> ./backend/.env

# ACM Observability will need to be installed first to set this env variable. Instructions: https://github.com/stolostron/multicluster-observability-operator
OBSERVABILITY_ROUTE=https://$(oc get route rbac-query-proxy -n open-cluster-management-observability -o="jsonpath={.status.ingress[0].host}")
echo OBSERVABILITY_ROUTE=$OBSERVABILITY_ROUTE >> ./backend/.env

PROMETHEUS_ROUTE=https://$(oc get route prometheus-k8s -n openshift-monitoring -o="jsonpath={.status.ingress[0].host}")
echo PROMETHEUS_ROUTE=$PROMETHEUS_ROUTE >> ./backend/.env