#!/usr/bin/env bash
# Writes a kubeconfig for the mg4-agent service account, valid for a limited time.
#
#   k8s/agent-access/make-kubeconfig.sh [duration] [output]
#
# Run it yourself, with your own (admin) kubeconfig active. duration defaults to 24h; the API
# server may cap it (--service-account-max-token-expiration). The token is written to the file
# only, never printed.
set -euo pipefail

duration="${1:-24h}"
out="${2:-$HOME/.config/nilsmg4/kubeconfig-mg4-agent}"

cluster="$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')"
server="$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')"
ca="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')"
if [ -z "$ca" ]; then
  ca_file="$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority}')"
  [ -n "$ca_file" ] || { echo "no cluster CA in the current kubeconfig" >&2; exit 1; }
  ca="$(base64 -w0 < "$ca_file")"
fi

token="$(kubectl create token mg4-agent --namespace mg4 --duration "$duration")"

mkdir -p "$(dirname "$out")"
umask 077
cat > "$out" <<KUBECONFIG
apiVersion: v1
kind: Config
clusters:
  - name: ${cluster}
    cluster:
      server: ${server}
      certificate-authority-data: ${ca}
users:
  - name: mg4-agent
    user:
      token: ${token}
contexts:
  - name: mg4-agent
    context:
      cluster: ${cluster}
      namespace: mg4
      user: mg4-agent
current-context: mg4-agent
KUBECONFIG

echo "Wrote $out (mode 600), token valid for $duration."
echo "Check: KUBECONFIG=$out kubectl auth can-i --list"