#!/bin/bash
# Cilium Bootstrap - Install Cilium CNI before helmfile
# Nodes require a CNI to become Ready. This script installs Cilium via Helm
# and applies L2 announcement policies (replacing MetalLB).
#
# Usage: ./scripts/cilium-bootstrap.sh

set -euo pipefail

echo "================================================="
echo "Cilium CNI Bootstrap"
echo "================================================="
echo ""

# Add Cilium Helm repo
echo "Adding Cilium Helm repository..."
helm repo add cilium https://helm.cilium.io 2>/dev/null || true
helm repo update cilium

# Check if Cilium is already installed
if helm -n kube-system status cilium >/dev/null 2>&1; then
  echo "✅ Cilium is already installed"
  echo ""
  echo "Upgrading Cilium to match helmfile values..."
  helm upgrade cilium cilium/cilium \
    --namespace kube-system \
    --values infrastructure/cilium/values.yaml \
    --wait --timeout 300s
else
  echo "Installing Cilium CNI..."
  helm install cilium cilium/cilium \
    --namespace kube-system \
    --values infrastructure/cilium/values.yaml \
    --wait --timeout 300s
fi

echo ""
echo "Waiting for Cilium to be ready..."
kubectl -n kube-system rollout status daemonset/cilium --timeout=300s

echo ""
echo "Applying L2 announcement policy and IP pool..."
kubectl apply -f infrastructure/cilium/l2-announcement-policy.yaml

echo ""
echo "Applying baseline network policies..."
kubectl apply -f infrastructure/cilium/network-policies/dns.yaml

# Apply per-namespace policies only if namespaces exist
for ns in vault authentik rook-ceph; do
  if kubectl get ns "$ns" >/dev/null 2>&1; then
    kubectl apply -f infrastructure/cilium/network-policies/baseline.yaml 2>/dev/null || true
    break
  fi
done

echo ""
echo "Verifying Cilium status..."
kubectl -n kube-system exec ds/cilium -- cilium status --brief 2>/dev/null || echo "  (cilium CLI check will be available after pods stabilize)"

echo ""
echo "Checking node readiness..."
kubectl get nodes -o wide

echo ""
echo "Verifying L2 announcements..."
kubectl get ciliuml2announcementpolicy,ciliumloadbalancerippool 2>/dev/null || echo "  (L2 CRDs being registered...)"

echo ""
echo "================================================="
echo "✅ Cilium CNI bootstrap complete"
echo "================================================="