#!/bin/bash
# Pre-deployment validation script for Portworx CSI on Talos Linux
# Checks prerequisites before deploying Portworx CSI driver

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

ERRORS=0
WARNINGS=0

echo "======================================================================"
echo "Portworx CSI Pre-Deployment Validation"
echo "======================================================================"
echo ""

# Function to print results
check_pass() {
    echo -e "${GREEN}✓${NC} $1"
}

check_fail() {
    echo -e "${RED}✗${NC} $1"
    ((ERRORS++))
}

check_warn() {
    echo -e "${YELLOW}!${NC} $1"
    ((WARNINGS++))
}

# Check kubectl connectivity
echo "=== Kubernetes Cluster Connectivity ==="
if kubectl cluster-info &>/dev/null; then
    check_pass "kubectl can connect to cluster"
    CLUSTER_NAME=$(kubectl config current-context)
    echo "   Context: $CLUSTER_NAME"
else
    check_fail "kubectl cannot connect to cluster"
    exit 1
fi
echo ""

# Check namespace
echo "=== Namespace Preparation ==="
if kubectl get namespace portworx &>/dev/null; then
    check_warn "Namespace 'portworx' already exists (expected if re-deploying)"
else
    check_pass "Namespace 'portworx' does not exist (will be created)"
fi
echo ""

# Check External Secrets Operator
echo "=== External Secrets Operator ==="
if kubectl get deployment -n external-secrets external-secrets &>/dev/null; then
    check_pass "External Secrets Operator is deployed"
    
    ESO_READY=$(kubectl get deployment -n external-secrets external-secrets -o jsonpath='{.status.readyReplicas}')
    if [ "$ESO_READY" -ge 1 ]; then
        check_pass "External Secrets Operator is ready ($ESO_READY replicas)"
    else
        check_fail "External Secrets Operator is not ready"
    fi
else
    check_fail "External Secrets Operator is not deployed (required for secret sync)"
fi
echo ""

# Check ClusterSecretStore
echo "=== ClusterSecretStore ==="
if kubectl get clustersecretstore onepassword &>/dev/null; then
    check_pass "ClusterSecretStore 'onepassword' exists"
    
    STORE_STATUS=$(kubectl get clustersecretstore onepassword -o jsonpath='{.status.conditions[0].status}')
    if [ "$STORE_STATUS" = "True" ]; then
        check_pass "ClusterSecretStore is ready"
    else
        check_warn "ClusterSecretStore may not be ready (status: $STORE_STATUS)"
    fi
else
    check_fail "ClusterSecretStore 'onepassword' not found (required for 1Password sync)"
fi
echo ""

# Check Talos nodes
echo "=== Talos Node Configuration ==="
NODES=$(kubectl get nodes -o jsonpath='{.items[*].metadata.name}')
NODE_COUNT=$(echo "$NODES" | wc -w)

if [ "$NODE_COUNT" -eq 0 ]; then
    check_fail "No nodes found in cluster"
else
    check_pass "Found $NODE_COUNT nodes in cluster"
    
    for NODE in $NODES; do
        echo "   Checking node: $NODE"
        
        # Check if Talos
        OS=$(kubectl get node "$NODE" -o jsonpath='{.status.nodeInfo.osImage}')
        if [[ "$OS" == *"Talos"* ]]; then
            check_pass "     Node is running Talos Linux"
        else
            check_warn "     Node is not running Talos Linux (OS: $OS)"
        fi
    done
fi
echo ""

# Note: Cannot check iSCSI/multipath from kubectl - requires talosctl access
echo "=== Talos iSCSI and Multipath (manual verification required) ==="
check_warn "Cannot verify iSCSI/multipath from kubectl - requires talosctl"
echo "   Run manually on each node:"
echo "     talosctl -n <node-ip> get service iscsid"
echo "     talosctl -n <node-ip> exec -- multipath -ll"
echo "     talosctl -n <node-ip> read /etc/iscsi/initiatorname.iscsi"
echo ""

# Check existing CSI drivers
echo "=== Existing CSI Drivers ==="
EXISTING_CSI=$(kubectl get csidrivers -o jsonpath='{.items[*].metadata.name}')
if [[ "$EXISTING_CSI" == *"pxd.portworx.com"* ]]; then
    check_warn "Portworx CSI driver already registered (re-deployment scenario)"
else
    check_pass "Portworx CSI driver not yet registered"
fi

if [ -n "$EXISTING_CSI" ]; then
    echo "   Existing CSI drivers:"
    for driver in $EXISTING_CSI; do
        echo "     - $driver"
    done
fi
echo ""

# Check for conflicting StorageClasses
echo "=== StorageClass Conflicts ==="
if kubectl get storageclass pure-block &>/dev/null; then
    check_warn "StorageClass 'pure-block' already exists (will be reconciled)"
else
    check_pass "StorageClass 'pure-block' does not exist"
fi

if kubectl get storageclass pure-file &>/dev/null; then
    check_warn "StorageClass 'pure-file' already exists (will be reconciled)"
else
    check_pass "StorageClass 'pure-file' does not exist"
fi
echo ""

# Check ArgoCD
echo "=== ArgoCD ==="
if kubectl get namespace argocd &>/dev/null; then
    check_pass "ArgoCD namespace exists"
    
    if kubectl get application -n argocd portworx-csi &>/dev/null; then
        check_warn "ArgoCD Application 'portworx-csi' already exists"
        
        APP_STATUS=$(kubectl get application -n argocd portworx-csi -o jsonpath='{.status.sync.status}')
        APP_HEALTH=$(kubectl get application -n argocd portworx-csi -o jsonpath='{.status.health.status}')
        echo "   Status: $APP_STATUS, Health: $APP_HEALTH"
    else
        check_pass "ArgoCD Application 'portworx-csi' does not exist (will be created)"
    fi
else
    check_fail "ArgoCD namespace not found (required for GitOps deployment)"
fi
echo ""

# Check if manifests exist in repo
echo "=== Repository Manifests ==="
MANIFEST_DIR="cluster/platform/portworx-csi"

if [ -d "$MANIFEST_DIR" ]; then
    check_pass "Portworx CSI manifest directory exists"
    
    REQUIRED_FILES=(
        "application.yaml"
        "operator-values.yaml"
        "storagecluster.yaml"
        "externalsecret.yaml"
        "storageclass-block.yaml"
        "storageclass-file.yaml"
    )
    
    for file in "${REQUIRED_FILES[@]}"; do
        if [ -f "$MANIFEST_DIR/$file" ]; then
            check_pass "   Found: $file"
        else
            check_fail "   Missing: $file"
        fi
    done
else
    check_fail "Portworx CSI manifest directory not found: $MANIFEST_DIR"
fi
echo ""

# Check for network connectivity to FlashArray (if endpoint is known)
echo "=== FlashArray Connectivity (manual verification recommended) ==="
check_warn "Cannot test FlashArray connectivity without endpoint"
echo "   Test manually:"
echo "     ping <flasharray-mgmt-ip>"
echo "     curl -k https://<flasharray-mgmt-ip>/api/2.0/arrays"
echo ""

# Summary
echo "======================================================================"
echo "Validation Summary"
echo "======================================================================"
if [ $ERRORS -eq 0 ] && [ $WARNINGS -eq 0 ]; then
    echo -e "${GREEN}✓ All checks passed!${NC}"
    echo "Ready to deploy Portworx CSI."
    exit 0
elif [ $ERRORS -eq 0 ]; then
    echo -e "${YELLOW}! $WARNINGS warnings found${NC}"
    echo "Deployment may proceed, but review warnings above."
    exit 0
else
    echo -e "${RED}✗ $ERRORS errors found${NC}"
    if [ $WARNINGS -gt 0 ]; then
        echo -e "${YELLOW}! $WARNINGS warnings found${NC}"
    fi
    echo ""
    echo "Please resolve errors before deploying Portworx CSI."
    exit 1
fi