#!/bin/bash
# scripts/grafana-bootstrap.sh
# Grafana presync bootstrap script

set -euo pipefail

echo "=== Grafana Bootstrap ==="

# Ensure namespace exists
kubectl get ns grafana >/dev/null 2>&1 || kubectl create ns grafana

# Apply External Secrets for Grafana OAuth
echo "Applying Grafana OAuth External Secret..."
kubectl apply -f ../base/external-secrets.yaml || echo "Warning: Some external secrets failed to apply (expected if namespaces don't exist)"

# Wait for External Secret to sync
echo "Waiting for Grafana OAuth External Secret to sync..."
for i in {1..30}; do
  STATUS=$(kubectl -n grafana get externalsecret grafana-oauth -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || echo "False")
  if [ "$STATUS" = "True" ]; then
    echo "Grafana OAuth External Secret is ready!"
    break
  fi
  echo "  waiting for External Secret to be ready... (attempt $i/30)"
  sleep 2
done

# Verify secret was created
if ! kubectl -n grafana get secret grafana-authentik-oauth >/dev/null 2>&1; then
  echo "WARNING: grafana-authentik-oauth secret not found. Ensure Vault has grafana-oauth credentials stored."
  echo "Run: ../../scripts/sync-grafana-oauth.sh"
else
  echo "Grafana OAuth secret successfully synced!"
fi

# Apply dashboard ConfigMaps
echo "Applying Grafana dashboard ConfigMaps..."
kubectl apply -f grafana/dashboards/

echo "✅ Grafana bootstrap complete"