/*
Copyright 2021 The cert-manager Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package app

import (
	"context"
	"fmt"
	"net/http"

	cmapi "github.com/cert-manager/cert-manager/pkg/api"
	"github.com/spf13/cobra"
	"k8s.io/apimachinery/pkg/api/validation"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/util/validation/field"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/kubernetes/scheme"
	clientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
	"k8s.io/client-go/tools/record"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/healthz"
	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"

	"github.com/cert-manager/istio-csr/cmd/app/options"
	"github.com/cert-manager/istio-csr/pkg/certmanager"
	"github.com/cert-manager/istio-csr/pkg/controller"
	"github.com/cert-manager/istio-csr/pkg/istiodcert"
	"github.com/cert-manager/istio-csr/pkg/server"
	"github.com/cert-manager/istio-csr/pkg/tls"
)

const (
	helpOutput = "cert-manager istio agent for signing istio agent certificate signing requests through cert-manager"
)

// NewCommand will return a new command instance for the istio agent.
func NewCommand(ctx context.Context) *cobra.Command {
	opts := options.New()

	cmd := &cobra.Command{
		Use:   "cert-manager-istio-csr",
		Short: helpOutput,
		Long:  helpOutput,
		RunE: func(cmd *cobra.Command, args []string) error {
			if err := opts.Complete(); err != nil {
				return err
			}

			if errs := validation.ValidateAnnotations(opts.CertManager.AdditionalAnnotations, field.NewPath("certificate-request-additional-annotations")); len(errs) > 0 {
				return errs.ToAggregate()
			}

			cm, err := certmanager.New(opts.Logr, opts.RestConfig, opts.CertManager)
			if err != nil {
				return fmt.Errorf("failed to initialise cert-manager manager: %w", err)
			}

			intscheme := runtime.NewScheme()
			if err := scheme.AddToScheme(intscheme); err != nil {
				return fmt.Errorf("failed to add kubernetes scheme: %s", err)
			}

			if err := cmapi.AddToScheme(intscheme); err != nil {
				return fmt.Errorf("failed to add cert-manager scheme: %s", err)
			}

			cl, err := kubernetes.NewForConfig(opts.RestConfig)
			if err != nil {
				return fmt.Errorf("error creating kubernetes client: %s", err.Error())
			}

			// Set the controller-runtime global logger which is used by its internal
			// logging (RuntimeLog, see link below).
			// https://github.com/kubernetes-sigs/controller-runtime/blob/6747c42ce33966b0e77cac278c6b9087cc2f51c7/pkg/internal/log/log.go#L31
			ctrl.SetLogger(opts.Logr)

			mlog := opts.Logr.WithName("manager")
			eventBroadcaster := record.NewBroadcaster()
			eventBroadcaster.StartLogging(func(format string, args ...interface{}) { mlog.V(3).Info(fmt.Sprintf(format, args...)) })
			eventBroadcaster.StartRecordingToSink(&clientv1.EventSinkImpl{Interface: cl.CoreV1().Events(opts.CertManager.Namespace)})

			mgr, err := ctrl.NewManager(opts.RestConfig, ctrl.Options{
				Scheme:                        intscheme,
				EventBroadcaster:              eventBroadcaster,
				LeaderElection:                true,
				LeaderElectionNamespace:       opts.Controller.LeaderElectionNamespace,
				LeaderElectionID:              "istio-csr",
				LeaderElectionReleaseOnCancel: true,
				ReadinessEndpointName:         opts.ReadyzPath,
				HealthProbeBindAddress:        fmt.Sprintf("0.0.0.0:%d", opts.ReadyzPort),
				Metrics: metricsserver.Options{
					BindAddress: fmt.Sprintf("0.0.0.0:%d", opts.MetricsPort),
				},
				Logger: mlog,
			})
			if err != nil {
				return fmt.Errorf("failed to create manager: %w", err)
			}

			if opts.IstiodCert.Enabled {
				istiodCertController, err := istiodcert.New(opts.Logr.WithName("istiod-dynamic"), opts.RestConfig, opts.IstiodCert, cm, opts.TLS.TrustDomain)
				if err != nil {
					return fmt.Errorf("failed to create dynamic istiod certificate provisioner: %s", err)
				}

				err = istiodCertController.AddControllersToManager(mgr)
				if err != nil {
					return fmt.Errorf("failed to add dynamic istiod cert controllers: %w", err)
				}
			}

			if opts.CertManager.HasRuntimeConfiguration() {
				if err := mgr.Add(cm.RuntimeConfigurationWatcher(ctx)); err != nil {
					return fmt.Errorf("failed to add runtime configuration watcher as runnable: %w", err)
				}
			}

			// Create a new TLS provider for the serving certificate and private key.
			tls, err := tls.NewProvider(opts.Logr, cm, opts.TLS, cm)
			if err != nil {
				return fmt.Errorf("failed to create tls provider: %w", err)
			}

			// Helper to only call health checks once issuer config is available
			deferCheckUntilIssuerConfig := func(check healthz.Checker) healthz.Checker {
				return func(req *http.Request) error {
					if cm.HasIssuerConfig() {
						return check(req)
					}
					return nil
				}
			}

			if err := mgr.AddReadyzCheck("tls_provider", deferCheckUntilIssuerConfig(tls.Check)); err != nil {
				return fmt.Errorf("failed to add tls provider readiness check: %w", err)
			}
			if err := mgr.Add(tls); err != nil {
				return fmt.Errorf("failed to add tls provider as runnable: %w", err)
			}

			// Create an new server instance that implements the certificate signing API
			server, err := server.New(opts.Logr, opts.RestConfig, cm, tls, opts.Server)
			if err != nil {
				return fmt.Errorf("failed to create grpc server: %w", err)
			}
			if err := mgr.AddReadyzCheck("grpc_server", deferCheckUntilIssuerConfig(server.Check)); err != nil {
				return fmt.Errorf("failed to add grpc server readiness check: %w", err)
			}
			if err := mgr.Add(server); err != nil {
				return fmt.Errorf("failed to add grpc server as runnable: %w", err)
			}

			// Add the ConfigMap controller that propagates the root CAs.
			if err := controller.AddConfigMapController(ctx, opts.Logr, controller.Options{
				TLS:                        tls,
				Manager:                    mgr,
				ConfigMapNamespaceSelector: opts.Controller.ConfigMapNamespaceSelector,
			}); err != nil {
				return fmt.Errorf("failed to add CA root controller: %w", err)
			}

			// Start all runnable and controller
			return mgr.Start(ctx)
		},
	}

	opts = opts.Prepare(cmd)

	return cmd
}
