#!/usr/bin/env bash
# Build .ci-diag/ in the CI workspace: a short-lived, least-privilege
# kubeconfig (ServiceAccount monitoring/ci-diagnostics, RBAC in
# kubernetes/apps/monitoring/ci-diagnostics-rbac.yaml) plus a copy of the
# kubectl binary, so a later ci-claude step (which ships no kubectl) can run
# read-only live diagnostics as ./.ci-diag/kubectl.
#
# Requires the admin kubeconfig at ~/.kube/config (fetch-kubeconfig.sh).
# Degrades gracefully: if the ServiceAccount does not exist yet (RBAC not
# reconciled), it prints a warning and exits 0 — agents then run in
# snapshot-only mode.
set -euo pipefail

DIAG_DIR=".ci-diag"
mkdir -p "$DIAG_DIR"

if ! TOKEN=$(kubectl -n monitoring create token ci-diagnostics --duration=1h 2>/dev/null); then
  echo "WARNING: could not mint a ci-diagnostics token (ServiceAccount missing" \
       "or no permission) — no $DIAG_DIR/kubeconfig, agents run snapshot-only."
  exit 0
fi

SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' \
  | base64 -d > "$DIAG_DIR/ca.crt"

KC="$DIAG_DIR/kubeconfig"
kubectl --kubeconfig="$KC" config set-cluster homelab \
  --server="$SERVER" --certificate-authority="$DIAG_DIR/ca.crt" --embed-certs=true >/dev/null
kubectl --kubeconfig="$KC" config set-credentials ci-diagnostics --token="$TOKEN" >/dev/null
kubectl --kubeconfig="$KC" config set-context diag --cluster=homelab --user=ci-diagnostics >/dev/null
kubectl --kubeconfig="$KC" config use-context diag >/dev/null
chmod 600 "$KC"
rm -f "$DIAG_DIR/ca.crt"

cp "$(command -v kubectl)" "$DIAG_DIR/kubectl"

# Smoke-test with the restricted identity so a broken RBAC surfaces HERE,
# in the pipeline log, not as a confusing tool failure inside the agent.
KUBECONFIG="$KC" "$DIAG_DIR/kubectl" get ns >/dev/null \
  && echo "diag kubeconfig OK (SA ci-diagnostics, 1h token)" \
  || { echo "WARNING: diag kubeconfig smoke test failed — removing it; agents run snapshot-only."; rm -f "$KC"; }