install.sh

#!/usr/bin/env bash
# install.sh — MFAOperator deployment and resource management
#
# Commands (first non-flag argument, default: operator):
#   operator    Deploy the MFAOperator to the cluster
#   certs       Create/update a Secret with LDAP CA certificates
#   customize   Create/update a ConfigMap with UI customization files
#   from-zip    Deploy certificates and customizations from a structured zip bundle
#
# Operator options:
#   --namespace NS     Operator namespace       (default: mfa-operator-system)
#   --image IMAGE      Operator container image
#   --minikube         Build image into minikube Docker daemon
#
# Certs options (./install.sh certs ...):
#   --namespace NS     Namespace of the MFAOperator CR  (default: default)
#   --instance NAME    MFAOperator CR name              (required)
#   --secret NAME      Secret name to create/update     (default: <instance>-ldap-certs)
#   --file PATH[:FN]   PEM/DER certificate file; FN = filename mounted at /etc/privacyidea/
#                      Repeat for multiple certs. FN defaults to the file basename.
#   --patch            Automatically patch the MFAOperator CR ldapCertificates list
#
# Customize options (./install.sh customize ...):
#   --namespace NS     Namespace of the MFAOperator CR  (default: default)
#   --instance NAME    MFAOperator CR name              (required)
#   --configmap NAME   ConfigMap name to create/update  (default: <instance>-branding)
#   --dir DIR          Directory with customization files (reads manifest.conf if present)
#   --patch            Automatically patch the MFAOperator CR customFiles list
#
# From-zip options (./install.sh from-zip ...):
#   --namespace NS            Namespace of the MFAOperator CR   (default: default)
#   --instance NAME           MFAOperator CR name               (required)
#   --zip FILE                Path to the zip bundle            (required)
#   --cert-secret NAME        Secret name for certificates      (default: <instance>-ldap-certs)
#   --custom-configmap NAME   ConfigMap name for customizations (default: <instance>-branding)
#   --patch                   Automatically patch the MFAOperator CR

set -euo pipefail

# ── Helpers ───────────────────────────────────────────────────────────────────
info()  { echo -e "\033[32m✓\033[0m $*"; }
warn()  { echo -e "\033[33m!\033[0m $*"; }
error() { echo -e "\033[31m✗\033[0m $*" >&2; exit 1; }

require() { command -v "$1" &>/dev/null || error "$1 is required but not installed."; }

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# ── Default well-known mount paths for customization files ────────────────────
default_mount_path() {
  local fname="$1"
  case "$fname" in
    menu.html)                            echo "/privacyidea/privacyidea/static/templates/menu.html" ;;
    baseline.html)                        echo "/privacyidea/privacyidea/static/templates/baseline.html" ;;
    tokenwizard.html)                     echo "/privacyidea/privacyidea/static/templates/tokenwizard.html" ;;
    *.png|*.jpg|*.jpeg|*.gif|*.svg|*.ico) echo "/privacyidea/privacyidea/static/css/$fname" ;;
    *)                                    echo "" ;;
  esac
}

# ── Patch ldapCertificates on a MFAOperator CR ───────────────────────────────
# Usage: patch_ldap_certs <namespace> <instance> <secretName> <filename>...
patch_ldap_certs() {
  local ns="$1" instance="$2" secret_name="$3"
  shift 3
  local -a filenames=("$@")

  python3 - "$ns" "$instance" "$secret_name" "${filenames[@]}" <<'PYEOF'
import json, subprocess, sys

ns, instance, secret_name, *filenames = sys.argv[1:]

cr_raw = subprocess.check_output(
    ['kubectl', 'get', 'mfaoperator', instance, '-n', ns, '-o', 'json'])
cr = json.loads(cr_raw)
spec = cr.get('spec', {})

# Merge: keyed by fileName so re-running updates rather than duplicates
existing = {e['fileName']: e for e in spec.get('ldapCertificates', [])}
for fn in filenames:
    existing[fn] = {'secretName': secret_name, 'key': fn, 'fileName': fn}
spec['ldapCertificates'] = list(existing.values())

patch = json.dumps({'spec': spec})
subprocess.check_call(
    ['kubectl', 'patch', 'mfaoperator', instance, '-n', ns, '--type=merge', '-p', patch])
print(f"  ldapCertificates updated: {list(existing.keys())}")
PYEOF
}

# ── Patch customFiles on a MFAOperator CR ────────────────────────────────────
# Usage: patch_custom_files <namespace> <instance> <configMapName> <key=mountPath>...
patch_custom_files() {
  local ns="$1" instance="$2" cm_name="$3"
  shift 3
  local -a entries=("$@")  # "key=mountPath" pairs

  python3 - "$ns" "$instance" "$cm_name" "${entries[@]}" <<'PYEOF'
import json, subprocess, sys

ns, instance, cm_name, *entries_raw = sys.argv[1:]

cr_raw = subprocess.check_output(
    ['kubectl', 'get', 'mfaoperator', instance, '-n', ns, '-o', 'json'])
cr = json.loads(cr_raw)
spec = cr.get('spec', {})

# Merge: keyed by mountPath
existing = {e['mountPath']: e for e in spec.get('customFiles', [])}
for e in entries_raw:
    key, mount = e.split('=', 1)
    existing[mount] = {'configMapName': cm_name, 'key': key, 'mountPath': mount}
spec['customFiles'] = list(existing.values())

patch = json.dumps({'spec': spec})
subprocess.check_call(
    ['kubectl', 'patch', 'mfaoperator', instance, '-n', ns, '--type=merge', '-p', patch])
print(f"  customFiles updated: {list(existing.keys())}")
PYEOF
}

# ── operator command ──────────────────────────────────────────────────────────
cmd_operator() {
  local NAMESPACE="mfa-operator-system"
  local IMAGE="mfa-operator:dev"
  local MINIKUBE=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --namespace) NAMESPACE="$2"; shift 2 ;;
      --image)     IMAGE="$2";     shift 2 ;;
      --minikube)  MINIKUBE=true;  shift ;;
      --help|-h)   grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//'; exit 0 ;;
      *) error "Unknown argument: $1" ;;
    esac
  done

  require kubectl
  require docker

  local CONTEXT; CONTEXT=$(kubectl config current-context)
  warn "Deploying to cluster context: $CONTEXT"
  warn "Namespace: $NAMESPACE"
  echo ""
  read -rp "Continue? [y/N] " confirm
  [[ "$confirm" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }
  echo ""

  cd "$SCRIPT_DIR"

  local PULL_POLICY
  if $MINIKUBE; then
    info "Building image into minikube Docker daemon..."
    eval "$(minikube docker-env)"
    IMAGE="mfa-operator:dev"
    docker build -t "$IMAGE" .
    PULL_POLICY="Never"
  else
    PULL_POLICY="IfNotPresent"
  fi

  info "Installing CRD..."
  kubectl apply -f config/crd/bases/mfaoperator.sec73.io_mfaoperators.yaml

  kubectl get namespace "$NAMESPACE" &>/dev/null || {
    info "Creating namespace $NAMESPACE..."
    kubectl create namespace "$NAMESPACE"
  }

  info "Applying RBAC..."
  kubectl apply -f config/rbac/role.yaml

  info "Deploying operator (image: $IMAGE)..."
  sed \
    -e "s|image:.*mfa-operator.*|image: ${IMAGE}|g" \
    -e "s|imagePullPolicy:.*|imagePullPolicy: ${PULL_POLICY}|g" \
    -e "s|namespace: mfa-operator-system|namespace: ${NAMESPACE}|g" \
    config/manager/manager.yaml | kubectl apply -f -

  info "Waiting for operator to become ready..."
  kubectl rollout status deployment/mfa-operator-controller-manager \
    -n "$NAMESPACE" --timeout=120s

  echo ""
  info "Operator installed successfully!"
  echo ""
  echo "  Next steps:"
  echo "  1. Create a Secret with PI_PEPPER, PI_SECRET, PI_ADMIN_PASS"
  echo "  2. kubectl apply -f config/samples/mfaoperator_v1alpha1_minimal.yaml"
  echo "  3. kubectl get mfaoperator -w"
  echo "  4. Use './install.sh certs' or './install.sh from-zip' to add certs/customizations"
  echo ""
}

# ── certs command ─────────────────────────────────────────────────────────────
cmd_certs() {
  local NAMESPACE="default"
  local INSTANCE=""
  local SECRET=""
  local DO_PATCH=false
  local -a FILES=()

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --namespace) NAMESPACE="$2"; shift 2 ;;
      --instance)  INSTANCE="$2";  shift 2 ;;
      --secret)    SECRET="$2";    shift 2 ;;
      --file)      FILES+=("$2");  shift 2 ;;
      --patch)     DO_PATCH=true;  shift ;;
      --help|-h)   grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//'; exit 0 ;;
      *) error "Unknown argument: $1" ;;
    esac
  done

  [[ -z "$INSTANCE" ]] && error "--instance is required"
  [[ ${#FILES[@]} -eq 0 ]] && error "At least one --file is required"
  [[ -z "$SECRET" ]] && SECRET="${INSTANCE}-ldap-certs"

  require kubectl

  local -a SECRET_ARGS=()
  local -a FILENAMES=()
  for filespec in "${FILES[@]}"; do
    local fpath fname
    IFS=':' read -r fpath fname <<< "$filespec"
    [[ -z "$fname" ]] && fname=$(basename "$fpath")
    [[ ! -f "$fpath" ]] && error "File not found: $fpath"
    SECRET_ARGS+=("--from-file=${fname}=${fpath}")
    FILENAMES+=("$fname")
  done

  info "Creating/updating Secret '${SECRET}' in namespace '${NAMESPACE}'..."
  kubectl create secret generic "$SECRET" \
    --namespace "$NAMESPACE" \
    "${SECRET_ARGS[@]}" \
    --dry-run=client -o yaml | kubectl apply -f -

  echo ""
  info "Add the following to your MFAOperator CR spec (${INSTANCE}):"
  echo ""
  echo "  ldapCertificates:"
  for fname in "${FILENAMES[@]}"; do
    echo "    - secretName: ${SECRET}"
    echo "      key: ${fname}"
    echo "      fileName: ${fname}"
  done
  echo ""

  if $DO_PATCH; then
    require python3
    info "Patching MFAOperator CR '${INSTANCE}'..."
    patch_ldap_certs "$NAMESPACE" "$INSTANCE" "$SECRET" "${FILENAMES[@]}"
    info "Done. The operator will trigger a rolling restart automatically."
  else
    info "Re-run with --patch to apply the CR changes automatically."
  fi
}

# ── customize command ─────────────────────────────────────────────────────────
cmd_customize() {
  local NAMESPACE="default"
  local INSTANCE=""
  local CONFIGMAP=""
  local DIR=""
  local DO_PATCH=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --namespace) NAMESPACE="$2"; shift 2 ;;
      --instance)  INSTANCE="$2";  shift 2 ;;
      --configmap) CONFIGMAP="$2"; shift 2 ;;
      --dir)       DIR="$2";       shift 2 ;;
      --patch)     DO_PATCH=true;  shift ;;
      --help|-h)   grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//'; exit 0 ;;
      *) error "Unknown argument: $1" ;;
    esac
  done

  [[ -z "$INSTANCE" ]] && error "--instance is required"
  [[ -z "$DIR" ]] && error "--dir is required"
  [[ ! -d "$DIR" ]] && error "Directory not found: $DIR"
  [[ -z "$CONFIGMAP" ]] && CONFIGMAP="${INSTANCE}-branding"

  require kubectl

  # Read manifest.conf if present
  local -A MANIFEST=()
  if [[ -f "${DIR}/manifest.conf" ]]; then
    info "Reading ${DIR}/manifest.conf..."
    while IFS='=' read -r key mountpath || [[ -n "$key" ]]; do
      [[ "$key" =~ ^[[:space:]]*#.*$ || -z "${key// /}" ]] && continue
      key="${key// /}"
      mountpath="${mountpath// /}"
      [[ -n "$key" && -n "$mountpath" ]] && MANIFEST["$key"]="$mountpath"
    done < "${DIR}/manifest.conf"
  fi

  local -a CM_ARGS=()
  local -a ENTRIES=()
  for fpath in "${DIR}"/*; do
    local fname; fname=$(basename "$fpath")
    [[ "$fname" == "manifest.conf" ]] && continue
    [[ ! -f "$fpath" ]] && continue
    CM_ARGS+=("--from-file=${fname}=${fpath}")

    local mountpath="${MANIFEST[$fname]:-}"
    [[ -z "$mountpath" ]] && mountpath=$(default_mount_path "$fname")
    if [[ -z "$mountpath" ]]; then
      warn "No mount path for '${fname}' — add it to manifest.conf (skipping CR entry)"
      continue
    fi
    ENTRIES+=("${fname}=${mountpath}")
  done

  [[ ${#CM_ARGS[@]} -eq 0 ]] && error "No files found in directory: $DIR"

  info "Creating/updating ConfigMap '${CONFIGMAP}' in namespace '${NAMESPACE}'..."
  kubectl create configmap "$CONFIGMAP" \
    --namespace "$NAMESPACE" \
    "${CM_ARGS[@]}" \
    --dry-run=client -o yaml | kubectl apply -f -

  echo ""
  info "Add the following to your MFAOperator CR spec (${INSTANCE}):"
  echo ""
  echo "  customFiles:"
  for entry in "${ENTRIES[@]}"; do
    local key mp
    IFS='=' read -r key mp <<< "$entry"
    echo "    - configMapName: ${CONFIGMAP}"
    echo "      key: ${key}"
    echo "      mountPath: ${mp}"
  done
  echo ""

  if $DO_PATCH; then
    require python3
    if [[ ${#ENTRIES[@]} -eq 0 ]]; then
      warn "No entries with known mount paths — cannot patch CR. Add mount paths to manifest.conf."
    else
      info "Patching MFAOperator CR '${INSTANCE}'..."
      patch_custom_files "$NAMESPACE" "$INSTANCE" "$CONFIGMAP" "${ENTRIES[@]}"
      info "Done. The operator will trigger a rolling restart automatically."
    fi
  else
    info "Re-run with --patch to apply the CR changes automatically."
  fi
}

# ── from-zip command ──────────────────────────────────────────────────────────
cmd_from_zip() {
  local NAMESPACE="default"
  local INSTANCE=""
  local ZIP=""
  local CERT_SECRET=""
  local CUSTOM_CM=""
  local DO_PATCH=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --namespace)        NAMESPACE="$2";   shift 2 ;;
      --instance)         INSTANCE="$2";    shift 2 ;;
      --zip)              ZIP="$2";         shift 2 ;;
      --cert-secret)      CERT_SECRET="$2"; shift 2 ;;
      --custom-configmap) CUSTOM_CM="$2";   shift 2 ;;
      --patch)            DO_PATCH=true;    shift ;;
      --help|-h)          grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//'; exit 0 ;;
      *) error "Unknown argument: $1" ;;
    esac
  done

  [[ -z "$INSTANCE" ]] && error "--instance is required"
  [[ -z "$ZIP" ]] && error "--zip is required"
  [[ ! -f "$ZIP" ]] && error "Zip file not found: $ZIP"
  [[ -z "$CERT_SECRET" ]] && CERT_SECRET="${INSTANCE}-ldap-certs"
  [[ -z "$CUSTOM_CM" ]] && CUSTOM_CM="${INSTANCE}-branding"

  require kubectl
  require unzip

  local TMPDIR; TMPDIR=$(mktemp -d)
  trap 'rm -rf "$TMPDIR"' EXIT

  info "Extracting ${ZIP}..."
  unzip -q "$ZIP" -d "$TMPDIR"

  local FOUND=false

  # ── Handle certs/ ──────────────────────────────────────────────────────────
  if [[ -d "${TMPDIR}/certs" ]]; then
    FOUND=true
    local -a SECRET_ARGS=()
    local -a FILENAMES=()
    for fpath in "${TMPDIR}/certs/"*; do
      [[ -f "$fpath" ]] || continue
      local fname; fname=$(basename "$fpath")
      SECRET_ARGS+=("--from-file=${fname}=${fpath}")
      FILENAMES+=("$fname")
    done

    if [[ ${#SECRET_ARGS[@]} -gt 0 ]]; then
      info "Creating/updating Secret '${CERT_SECRET}' (${#FILENAMES[@]} certificate(s))..."
      kubectl create secret generic "$CERT_SECRET" \
        --namespace "$NAMESPACE" \
        "${SECRET_ARGS[@]}" \
        --dry-run=client -o yaml | kubectl apply -f -

      echo ""
      info "ldapCertificates entries for CR '${INSTANCE}':"
      for fname in "${FILENAMES[@]}"; do
        echo "    - secretName: ${CERT_SECRET}"
        echo "      key: ${fname}"
        echo "      fileName: ${fname}"
      done
      echo ""

      if $DO_PATCH; then
        require python3
        info "Patching '${INSTANCE}' ldapCertificates..."
        patch_ldap_certs "$NAMESPACE" "$INSTANCE" "$CERT_SECRET" "${FILENAMES[@]}"
      fi
    else
      warn "certs/ directory is empty — skipping"
    fi
  fi

  # ── Handle customizations/ ─────────────────────────────────────────────────
  if [[ -d "${TMPDIR}/customizations" ]]; then
    FOUND=true

    local -A MANIFEST=()
    if [[ -f "${TMPDIR}/customizations/manifest.conf" ]]; then
      info "Reading customizations/manifest.conf..."
      while IFS='=' read -r key mountpath || [[ -n "$key" ]]; do
        [[ "$key" =~ ^[[:space:]]*#.*$ || -z "${key// /}" ]] && continue
        key="${key// /}"
        mountpath="${mountpath// /}"
        [[ -n "$key" && -n "$mountpath" ]] && MANIFEST["$key"]="$mountpath"
      done < "${TMPDIR}/customizations/manifest.conf"
    fi

    local -a CM_ARGS=()
    local -a ENTRIES=()
    for fpath in "${TMPDIR}/customizations/"*; do
      local fname; fname=$(basename "$fpath")
      [[ "$fname" == "manifest.conf" ]] && continue
      [[ ! -f "$fpath" ]] && continue
      CM_ARGS+=("--from-file=${fname}=${fpath}")

      local mountpath="${MANIFEST[$fname]:-}"
      [[ -z "$mountpath" ]] && mountpath=$(default_mount_path "$fname")
      if [[ -z "$mountpath" ]]; then
        warn "No mount path for '${fname}' — add it to manifest.conf (skipping CR entry)"
        continue
      fi
      ENTRIES+=("${fname}=${mountpath}")
    done

    if [[ ${#CM_ARGS[@]} -gt 0 ]]; then
      info "Creating/updating ConfigMap '${CUSTOM_CM}' (${#CM_ARGS[@]} file(s))..."
      kubectl create configmap "$CUSTOM_CM" \
        --namespace "$NAMESPACE" \
        "${CM_ARGS[@]}" \
        --dry-run=client -o yaml | kubectl apply -f -

      echo ""
      info "customFiles entries for CR '${INSTANCE}':"
      for entry in "${ENTRIES[@]}"; do
        local key mp
        IFS='=' read -r key mp <<< "$entry"
        echo "    - configMapName: ${CUSTOM_CM}"
        echo "      key: ${key}"
        echo "      mountPath: ${mp}"
      done
      echo ""

      if $DO_PATCH && [[ ${#ENTRIES[@]} -gt 0 ]]; then
        require python3
        info "Patching '${INSTANCE}' customFiles..."
        patch_custom_files "$NAMESPACE" "$INSTANCE" "$CUSTOM_CM" "${ENTRIES[@]}"
      fi
    else
      warn "customizations/ directory is empty — skipping"
    fi
  fi

  $FOUND || error "Zip archive must contain a certs/ and/or customizations/ directory"

  $DO_PATCH && info "Done. The operator will trigger a rolling restart automatically." || true
}

# ── Main dispatch ──────────────────────────────────────────────────────────────
COMMAND="operator"
if [[ $# -gt 0 && "$1" != -* ]]; then
  COMMAND="$1"; shift
fi

case "$COMMAND" in
  operator)  cmd_operator  "$@" ;;
  certs)     cmd_certs     "$@" ;;
  customize) cmd_customize "$@" ;;
  from-zip)  cmd_from_zip  "$@" ;;
  help)      grep '^#' "$0" | grep -v '#!/' | sed 's/^# \?//'; exit 0 ;;
  *) error "Unknown command: '${COMMAND}'. Use: operator | certs | customize | from-zip" ;;
esac