#!/usr/bin/env bash
# setup_accuknox.sh — Fresh Ubuntu → MicroK8s + Helm + AccuKnox agents (simple, reliable)
# - No 'newgrp' trickery; uses sudo for MicroK8s steps
# - Then configures plain 'helm' + 'kubectl' via ~/.kube/config
# - Prompts for AccuKnox values, installs agents, shows status

set -euo pipefail

step() { echo -e "\n[$(date +%H:%M:%S)] $*"; }

# 1) Packages
step "Updating packages and installing prerequisites..."
sudo apt update -y
sudo apt install -y snapd curl jq apparmor apparmor-utils

# 2) MicroK8s
step "Installing MicroK8s..."
sudo snap install microk8s --classic
step "Waiting for MicroK8s to be ready..."
sudo microk8s status --wait-ready

# 3) Core addons
step "Enabling core addons (dns, hostpath-storage)..."
sudo microk8s enable dns hostpath-storage

# 4) Helm v3
step "Installing Helm v3..."
sudo snap install helm --classic

# 5) Kubeconfig for plain kubectl/helm
step "Configuring kubeconfig for current user..."
mkdir -p "${HOME}/.kube"
sudo microk8s config > "${HOME}/.kube/config"
chmod 600 "${HOME}/.kube/config"

# Ensure kubectl points to MicroK8s
export KUBECONFIG="${HOME}/.kube/config"

# 6) Quick cluster sanity
step "Cluster sanity..."
kubectl get nodes
kubectl -n kube-system get pods | head -n 20

# 7) AccuKnox inputs
echo
echo "=== Enter AccuKnox credentials ==="
read -rp "Tenant ID (e.g., 7360): " AK_TENANT_ID
read -rsp "Auth Token (masked): " AK_AUTH_TOKEN; echo
read -rsp "Join Token (masked): " AK_JOIN_TOKEN; echo
read -rp "Cluster Name [default: test4]: " AK_CLUSTER_NAME; AK_CLUSTER_NAME="${AK_CLUSTER_NAME:-test4}"
read -rp "Agent Label [default: windows]: " AK_LABEL; AK_LABEL="${AK_LABEL:-windows}"
read -rp "CronTab for Jobs [default: 10 * * * *]: " AK_CRONTAB; AK_CRONTAB="${AK_CRONTAB:-10 * * * *}"
read -rp "Portal URL [default: demo.accuknox.com]: " AK_PORTAL_URL; AK_PORTAL_URL="${AK_PORTAL_URL:-demo.accuknox.com}"
read -rp "Chart Version [default: v0.1.11]: " AK_CHART_VERSION; AK_CHART_VERSION="${AK_CHART_VERSION:-v0.1.11}"

# Basic validation
if [[ -z "${AK_TENANT_ID}" || -z "${AK_AUTH_TOKEN}" || -z "${AK_JOIN_TOKEN}" ]]; then
  echo "ERROR: Tenant ID, Auth Token, and Join Token are required." >&2
  exit 1
fi

# 8) Install AccuKnox agents with plain 'helm'
step "Installing AccuKnox agents (OCI chart) with Helm..."
export HELM_EXPERIMENTAL_OCI=1

helm upgrade --install agents oci://public.ecr.aws/k9v9d5v2/kspm-runtime \
  -n agents --create-namespace \
  --set global.agents.enabled=true \
  --set-string global.agents.joinToken="${AK_JOIN_TOKEN}" \
  --set-string global.agents.url="${AK_PORTAL_URL}" \
  --set kyverno.enabled=true \
  --set admissionController.enabled=true \
  --set kubearmor-operator.enabled=true \
  --set kubearmor-operator.autoDeploy=true \
  --set global.enableJobsUrl=true \
  --set global.kiem.enabled=true \
  --set global.riskassessment.enabled=true \
  --set global.cis.enabled=true \
  --set-string global.tenantId="${AK_TENANT_ID}" \
  --set-string global.authToken="${AK_AUTH_TOKEN}" \
  --set-string global.clusterName="${AK_CLUSTER_NAME}" \
  --set-string global.cronTab="${AK_CRONTAB}" \
  --set-string global.label="${AK_LABEL}" \
  --version "${AK_CHART_VERSION}" \
  --wait --timeout 30m

# 9) Status
step "Installation complete. Agents namespace status:"
kubectl -n agents get pods -o wide || true
echo
kubectl -n agents get events --sort-by=.lastTimestamp | tail -n 60 || true

echo
echo "=== DONE ==="
echo "Next steps:"
echo " 1) In AccuKnox portal, confirm the cluster shows as CONNECTED."
echo " 2) Set up Fluent Bit on Windows to forward Event Logs → Fluent Bit on Ubuntu → (UDP/TCP syslog or forward) → AccuKnox agents."
echo " 3) Trigger a Windows Security event (e.g., failed logon) and verify it appears in AccuKnox logs/alerts."