#!/bin/bash
# gitlab-add-hostaliases.sh
# Add hostAliases to GitLab deployments for Authentik OIDC

set -euo pipefail

echo "=== Adding hostAliases to GitLab deployments ==="

NS=gitlab
# Route via Istio ingressgateway LoadBalancer (ingress-nginx removed)
EDGE_IP=$(kubectl get svc -n istio-system istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

echo "Istio edge gateway IP: $EDGE_IP"

# Check if webservice deployment already has hostAliases
if kubectl get deployment gitlab-webservice-default -n "${NS}" -o jsonpath='{.spec.template.spec.hostAliases}' | grep -q "${EDGE_IP}"; then
  echo "✅ webservice already has hostAliases configured"
else
  echo "Adding hostAliases to webservice..."
  kubectl patch deployment gitlab-webservice-default -n "${NS}" --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/template/spec/hostAliases\", \"value\": [{\"ip\": \"${EDGE_IP}\", \"hostnames\": [\"auth.kube.huskypup.net\"]}]}]"
  echo "✅ hostAliases added to webservice"
fi

# Check if sidekiq deployment already has hostAliases
if kubectl get deployment gitlab-sidekiq-all-in-1-v2 -n "${NS}" -o jsonpath='{.spec.template.spec.hostAliases}' | grep -q "${EDGE_IP}"; then
  echo "✅ sidekiq already has hostAliases configured"
else
  echo "Adding hostAliases to sidekiq..."
  kubectl patch deployment gitlab-sidekiq-all-in-1-v2 -n "${NS}" --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/template/spec/hostAliases\", \"value\": [{\"ip\": \"${EDGE_IP}\", \"hostnames\": [\"auth.kube.huskypup.net\"]}]}]"
  echo "✅ hostAliases added to sidekiq"
fi

echo ""
echo "=== hostAliases configuration complete ==="
echo "GitLab will now route auth.kube.huskypup.net through Istio edge gateway (${EDGE_IP})"
echo "This ensures proper SSL certificate validation for Authentik OIDC"