#!/usr/bin/env bash
set -Eeuo pipefail

CLUSTER_NAME="cks-lab"
KUBECONFIG_PATH="/opt/cks-lab/kubeconfig"
NODE_IMAGE="kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a"
CALICO_VERSION="v3.32.1"
CONFIG_PATH="${1:?Pass the Kind configuration path.}"

if [[ "${EUID}" -ne 0 ]]; then
  echo "Run this script as root inside the lab WSL distribution." >&2
  exit 1
fi

systemctl start docker 2>/dev/null || service docker start
install -d -m 0700 /opt/cks-lab

if ! kind get clusters | grep -Fxq "$CLUSTER_NAME"; then
  kind create cluster \
    --name "$CLUSTER_NAME" \
    --image "$NODE_IMAGE" \
    --config "$CONFIG_PATH" \
    --kubeconfig "$KUBECONFIG_PATH"
fi

export KUBECONFIG="$KUBECONFIG_PATH"
chmod 0600 "$KUBECONFIG"
context="$(kubectl config current-context)"
if [[ "$context" != "kind-${CLUSTER_NAME}" ]]; then
  echo "Safety check failed: unexpected context $context" >&2
  exit 1
fi

kubectl apply -f "https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/operator-crds.yaml"
kubectl apply -f "https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/tigera-operator.yaml"
kubectl apply -f "https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/custom-resources.yaml"

kubectl wait --for=condition=Available deployment/tigera-operator -n tigera-operator --timeout=300s
kubectl wait --for=condition=Ready nodes --all --timeout=600s

for node in "${CLUSTER_NAME}-control-plane" "${CLUSTER_NAME}-worker"; do
  docker exec "$node" rm -rf /opt/kube-bench
  docker cp /opt/cks-lab/tools/kube-bench "$node":/opt/kube-bench
  docker exec "$node" /opt/kube-bench/kube-bench version
done