#!/bin/bash
# argocd-add-hostaliases.sh
# Add hostAliases to ArgoCD server for Authentik OIDC

set -euo pipefail

echo "=== Adding hostAliases to ArgoCD server ==="

NS=argocd
EDGE_IP=$(kubectl get svc -n istio-system istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

echo "Istio edge gateway IP: $EDGE_IP"

if kubectl get deployment argocd-server -n "${NS}" -o jsonpath='{.spec.template.spec.hostAliases}' | grep -q "${EDGE_IP}"; then
  echo "✅ argocd-server already has hostAliases configured"
else
  echo "Adding hostAliases to argocd-server..."
  kubectl patch deployment argocd-server -n "${NS}" --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/template/spec/hostAliases\", \"value\": [{\"ip\": \"${EDGE_IP}\", \"hostnames\": [\"auth.kube.huskypup.net\"]}]}]"
  echo "✅ hostAliases added to argocd-server"
fi

echo ""
echo "=== hostAliases configuration complete ==="
echo "ArgoCD will now route auth.kube.huskypup.net through Istio edge gateway (${EDGE_IP})"
echo "This ensures proper SSL certificate validation for Authentik OIDC"