import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";
import { datadogApiKey, datadogAppKey, datadogRdsSecret } from "./config";
import { Output } from "@pulumi/pulumi";
import { Cluster } from "@pulumi/eks";

export const createDatadogSecret = ({
  sunoMainDbClusterIdentifier,
  sunoMainAllReplicaEndpoints,
  sunoChopinDbClusterIdentifier,
  sunoChopinAllReplicaEndpoints,
  sunoMainDbSecretArn,
  sunoChopinDbSecretArn,
  cluster,
}: {
  sunoMainAllReplicaEndpoints: Output<string>[];
  sunoChopinAllReplicaEndpoints: Output<string>[];
  sunoMainDbSecretArn: Output<string>;
  sunoChopinDbSecretArn: Output<string>;
  sunoChopinDbClusterIdentifier: Output<string>;
  sunoMainDbClusterIdentifier: Output<string>;
  cluster: Cluster;
}) => {
  const secret = new aws.secretsmanager.Secret("datadog", {
    name: "datadog-keys",
    description: "Secret for Datadog API Key",
  });

  // Add the secret values
  new aws.secretsmanager.SecretVersion("datadog-version", {
    secretId: secret.id,
    secretString: JSON.stringify({
      "api-key": datadogApiKey,
      "app-key": datadogAppKey,
    }),
  });

  const ddRdsSecret = new aws.secretsmanager.Secret("datadog-rds-config", {
    name: "datadog-rds-config",
    description: "Secret for Datadog RDS Integration",
  });

  new aws.secretsmanager.SecretVersion("datadog-rds-version", {
    secretId: ddRdsSecret.id,
    secretString: pulumi
      .all([
        sunoMainAllReplicaEndpoints,
        sunoMainDbClusterIdentifier,
        sunoChopinAllReplicaEndpoints,
        sunoChopinDbClusterIdentifier,
      ])
      .apply(
        ([
          sunoMainAllReplicaEndpoints,
          sunoMainDbClusterIdentifier,
          sunoChopinAllReplicaEndpoints,
          sunoChopinDbClusterIdentifier,
        ]) => {
          return JSON.stringify(
            sunoMainAllReplicaEndpoints.map((endpoint) => {
              return {
                dbm: true,
                username: "datadog",
                password: datadogRdsSecret,
                host: endpoint,
                port: 5432,
                tags: [
                  `env:${pulumi.getStack()}`,
                  `dbclusteridentifier:${sunoMainDbClusterIdentifier}`,
                ],
              };
            })
          );
        }
      ),
  });

  const ddInitJobSecret = new aws.secretsmanager.Secret("datadog-init-job", {
    name: "datadog-init-job",
    description: "Secret for Datadog Init Job",
  });

  new aws.secretsmanager.SecretVersion("datadog-init-job-version", {
    secretId: ddInitJobSecret.id,
    secretString: pulumi
      .all([
        sunoChopinDbSecretArn,
        sunoMainDbSecretArn,
        sunoMainAllReplicaEndpoints,
        sunoChopinAllReplicaEndpoints,
      ])
      .apply(
        ([
          sunoChopinDbSecretArn,
          sunoMainDbSecretArn,
          sunoMainAllReplicaEndpoints,
          sunoChopinAllReplicaEndpoints,
        ]) => {
          return JSON.stringify({
            DATADOG_USER: "datadog",
            DATADOG_PASSWORD: datadogRdsSecret,
            DATABASES: [
              {
                endpoint: sunoMainAllReplicaEndpoints[0],
                secretArn: sunoMainDbSecretArn,
              },
              {
                endpoint: sunoChopinAllReplicaEndpoints[0],
                secretArn: sunoChopinDbSecretArn,
              },
            ],
          });
        }
      ),
  });

  const namespace = new k8s.core.v1.Namespace(
    "datadog",
    {
      metadata: {
        name: "datadog",
      },
    },
    { provider: cluster.provider }
  );

  const serviceAccount = new k8s.core.v1.ServiceAccount(
    "datadog-init-job",
    {
      metadata: {
        name: "datadog-init-job",
        namespace: namespace.metadata.name,
      },
    },
    { provider: cluster.provider }
  );

  const role = serviceAccount.metadata.apply((metadata) => {
    return new aws.iam.Role("datadog-init-job-role", {
      assumeRolePolicy: pulumi
        .all([cluster.core.oidcProvider?.url, cluster.core.oidcProvider?.arn])
        .apply(([url, arn]) => {
          return JSON.stringify({
            Version: "2012-10-17",
            Statement: [
              {
                Effect: "Allow",
                Principal: {
                  Federated: arn,
                },
                Action: "sts:AssumeRoleWithWebIdentity",
                Condition: {
                  StringEquals: {
                    [`${url}:sub`]: `system:serviceaccount:${metadata.namespace}:${metadata.name}`,
                  },
                },
              },
            ],
          });
        }),
    });
  });

  const policy = new aws.iam.Policy("datadog-init-job-policy", {
    policy: {
      Version: "2012-10-17",
      Statement: [
        {
          Effect: "Allow",
          Action: [
            "secretsmanager:GetResourcePolicy",
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret",
            "secretsmanager:ListSecretVersionIds",
            "secretsmanager:ListSecrets",
          ],
          Resource: ["*"],
        },
      ],
    },
  });

  new aws.iam.RolePolicyAttachment("datadog-init-job-pa", {
    role: role.name,
    policyArn: policy.arn,
  });

  new k8s.core.v1.ServiceAccountPatch(
    "datadog-init-job-patch",
    {
      metadata: {
        name: serviceAccount.metadata.name,
        namespace: serviceAccount.metadata.namespace,
        annotations: {
          "eks.amazonaws.com/role-arn": role.arn,
        },
      },
    },
    { provider: cluster.provider }
  );
};