# defines variables
AZURE_LOCATION=westeurope
CERT_MANAGER_VERSION=v1.12.4
EMAIL_ADDRESS=my@own.email
KUBERNETES_VERSION=v1.26.6
NODE_COUNT=2
RANCHER_VERSION=2.7.6
RESOURCE_PREFIX=bth-tmp20230932
SUBSCRIPTION_ID=XXXXXXXXXXXX
VM_SIZE=Standard_D2s_v3

# displays versions
az version
kubectl version
helm version

# adds helm repositories
helm repo add devpro         https://devpro.github.io/helm-charts
helm repo add jetstack       https://charts.jetstack.io
helm repo add ingress-nginx  https://kubernetes.github.io/ingress-nginx
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
helm repo update

# authenticates to Azure (will open a window in your browser)
az login

# makes sure the right subscription will be used
az account set --subscription $SUBSCRIPTION_ID

# creates the resource group
az group create --name rg-${RESOURCE_PREFIX} --location ${AZURE_LOCATION}

# create AKS resource (Kubernetes cluster managed by Azure)
az aks create \
  --resource-group rg-${RESOURCE_PREFIX} \
  --name aks-${RESOURCE_PREFIX} \
  --kubernetes-version ${KUBERNETES_VERSION} \
  --node-count ${NODE_COUNT} \
  --node-vm-size ${VM_SIZE}

# adds cluster credentials to local kubectl config
az aks get-credentials --resource-group rg-${RESOURCE_PREFIX} --name aks-${RESOURCE_PREFIX}

# fixes permission issues on WSL
chmod 600 ~/.kube/config

# makes sure we can query the cluster
kubectl get nodes

# installs NGINX Ingress (the annotation is a fix required for Kubernetes 1.24+)
helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace \
  --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz

# makes sure everything is ok
kubectl get services -n ingress-nginx

# stores the external public IP (must not be null!)
NGINX_PUBLIC_IP=`kubectl get service -n ingress-nginx ingress-nginx-controller --output jsonpath='{.status.loadBalancer.ingress[0].ip}'`

# installs the CRDs
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.crds.yaml

# installs cert-manager
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version $CERT_MANAGER_VERSION

# makes sure the 3 pods are in Running status
kubectl get pods --namespace cert-manager

# creates cluster issuers
helm upgrade --install letsencrypt devpro/letsencrypt \
  --set registration.emailAddress=$EMAIL_ADDRESS \
  --namespace cert-manager

# makes sure the 2 cluster issuers are Ready (True)
kubectl get clusterissuer -n cert-manager

# installs Rancher
kubectl create namespace cattle-system
helm upgrade --install rancher rancher-latest/rancher \
  --namespace cattle-system \
  --set hostname=rancher.${NGINX_PUBLIC_IP}.sslip.io \
  --set 'ingress.extraAnnotations.cert-manager\.io/cluster-issuer=letsencrypt-prod' \
  --set ingress.ingressClassName=nginx \
  --set ingress.tls.source=secret \
  --set ingress.tls.secretName=rancher-tls \
  --set replicas=2 \
  --version $RANCHER_VERSION

# waits for the installation to complete
kubectl -n cattle-system rollout status deploy/rancher

# retrieves the generated password (to be copied)
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ .data.bootstrapPassword|base64decode}}{{ "\n" }}'

# displays the Rancher URL
echo "https://rancher.${NGINX_PUBLIC_IP}.sslip.io/"

# deletes the cluster
az aks delete --name aks-${RESOURCE_PREFIX} --resource-group rg-${RESOURCE_PREFIX}

# deletes the resource group
az group delete --name rg-${RESOURCE_PREFIX}

# cleans the local kube config file
kubectl config unset users.clusterUser_rg-${RESOURCE_PREFIX}_aks-aks-${RESOURCE_PREFIX}
kubectl config unset contexts.aks-${RESOURCE_PREFIX}
kubectl config unset clusters.aks-${RESOURCE_PREFIX}