#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

function generate-application-admin-manifests() {

    # This variables gets injected automatically by github actions docker type, declaring locals just for clarity of the code.
    local _prefix="$PREFIX"
    local _app_definitions_path="$GITHUB_WORKSPACE"
    local _checkout_path="$GITHUB_WORKSPACE/cloned_repos"
    local _cluster_definitions_path="$_checkout_path/$_prefix-cluster-management"
    local _org="$GITHUB_REPOSITORY_OWNER"
    local _cluster_state_folder="$_checkout_path/$_prefix-cluster-state"
    # shellcheck disable=SC2154
    _application_names="$application_secret_mappings"

    for app_key in $(echo "${_application_names}" | jq -r '.[] | @base64'); do
        app=$( echo "${app_key}" | base64 --decode |  jq -r '.name')
        ssh_key=$( echo "${app_key}" | base64 --decode |  jq -r '.ssh_key')

        _app_state_repo_path="$_checkout_path/$_prefix-$app-state"
        echo "Generating Helm Release, Namespace for $app, using path: $_app_state_repo_path"
        "$TOOLS_PATH"/adminc12render -a "$_app_definitions_path"/"$app".yaml -c "$_cluster_definitions_path" -o "$_org" -p "$_prefix" -d "$_cluster_state_folder" -s "$ssh_key"
    done
}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    generate-application-admin-manifests
fi


#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/terraform-utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/terraform-utils.sh"

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

function generate-clone-repos-actions() {

    pushd .c12/components/infrastructure/repos/github-enterprise-cloud

    #This variables gets injected automatically by github actions docker type, declaring locals just for clarity of the code.
    local ORG="$GITHUB_REPOSITORY_OWNER"

    _application_names=$(get-application-list-json)
    _access_token="$PAT_TOKEN"
    _org="$ORG"
    _prefix="$PREFIX"
    _applications="$_application_names"
    _timestamp="$(date "+%Y-%m-%d_%H-%M")"

    terraform_init_gh

    terraform plan \
    -lock=true \
    -out "${_timestamp}.tfplan" \
    -var "access_token=$_access_token" \
    -var "org=$_org" \
    -var "prefix=$_prefix" \
    -var "applications=$_applications"

    if [ -z "${TF_DRY_RUN+set}" ];
    then
        terraform apply "${_timestamp}.tfplan"
    fi
    popd
}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    generate-clone-repos-actions
fi


#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/terraform-utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/terraform-utils.sh"

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

function generate-deploy-keys-actions() {
    pushd .c12/components/infrastructure/repos/deploy-keys

    #This variables gets injected automatically by github actions docker type, declaring locals just for clarity of the code.
    local ORG="$GITHUB_REPOSITORY_OWNER"
    _application_names=$(get-application-list-json)

    echo "Applications found: $_application_names"

    _subscription_id="$ARM_SUBSCRIPTION_ID"
    _prefix="$PREFIX"
    _applications="$_application_names"
    _access_token="$PAT_TOKEN"
    _org="$ORG"

    _timestamp="$(date "+%Y-%m-%d_%H-%M")"

    terraform_init_gh

    terraform plan \
        -lock=true \
        -out "${_timestamp}.tfplan" \
        -var "subscription_id=$_subscription_id" \
        -var "org=$_org" \
        -var "access_token=$_access_token" \
        -var "prefix=$_prefix" \
        -var "applications=$_applications"

    if [ -z "${TF_DRY_RUN+set}" ];
    then
        terraform apply "${_timestamp}.tfplan"

        # get generated keys from Terraform to deploy to app-states.
        _app_keys=$( terraform output -json | jq -c '."application-secret-mappings".value' )
        echo "_app_keys: $_app_keys"
        # sets as ENV var for next task in pipeline
        echo "::set-env name=application_secret_mappings::$_app_keys"
    fi
    popd

}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    generate-deploy-keys-actions
fi


#!/usr/bin/env bash

TOOLS_PATH="/app"

# shellcheck source=src/runtime/pipelines/application-management/scripts/terraform-utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/terraform-utils.sh"

function generate-pipeline-secrets-actions() {

    set -euo pipefail
    pushd .c12/components/infrastructure/azure/aad_credentials_actions/
    chmod 777 ./post_grant_request.sh

    az login --service-principal -u "$ARM_CLIENT_ID" -p "$ARM_CLIENT_SECRET" -t "$ARM_TENANT_ID"

    #This variables gets injected automatically by github actions docker type, declaring locals just for clarity of the code.
    local ORG="$GITHUB_REPOSITORY_OWNER"

    APP_LIST_JSON=$("${TOOLS_PATH}"/appsourceextractor -a "${GITHUB_WORKSPACE}")
    APP_LIST=$(echo "$APP_LIST_JSON" | tail -1 | jq -r '.[]')
    echo "Apps found: $APP_LIST"

    _access_token="$PAT_TOKEN"
    _access_token_username="$PAT_USERNAME"
    _org="$ORG"
    _prefix="$PREFIX"
    _subscription_id="$ARM_SUBSCRIPTION_ID"
    _ci_acr_name="$CI_ACR_NAME"
    _timestamp="$(date "+%Y-%m-%d_%H-%M")"

    _required_repos="archetype-management application-management"

    _repositories="["
    for repo in $_required_repos
    do
         _repositories=$_repositories"\"""$_prefix"-"$repo""\", "
    done
    for repo in $APP_LIST
    do
         _repositories=$_repositories"\"""$_prefix"-"$repo"'-src'"\", "
    done
    # Trim the last two charcaters
    _repositories="${_repositories%??}""]"
    echo "Repositories: ${_repositories}"

    terraform_init_gh

    terraform plan \
    -lock=true \
    -out "${_timestamp}.tfplan" \
    -var "subscription_id=$_subscription_id" \
    -var "prefix=$_prefix"\
    -var "org=$_org" \
    -var "access_token=$_access_token" \
    -var "access_token_username=$_access_token_username" \
    -var "repositories=$_repositories"\
    -var "ci_acr_name=$_ci_acr_name"

    if [ -z "${TF_DRY_RUN+set}" ];
    then
        terraform apply "${_timestamp}.tfplan"
    fi
    popd
}

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    generate-pipeline-secrets-actions
fi


#!/usr/bin/env bash

function clone-repo() {

    local _repo_name
    local _pat_username

    _repo_name="$1"
    _pat_username="$2"
    _pat_password="$3"
    _github_repository_owner="$4"

    git_url="https://${_pat_username}:${_pat_password}@github.com/$_github_repository_owner/$_repo_name.git"

    echo "Cloning: $_repo_name"

    git clone "$git_url"
    pushd "$_repo_name" || exit 2
    git config --local gc.auto 0
    popd || exit 2
}

function clone-state-only-repo() {
    set -euo pipefail

    local _org="$1"
    local _pat_username="$3"
    local _pat_password="$4"
    local _app_name="$5"

    # clone clone application state/source repos
    echo "Clonning state app with name: '$_app_name'"
    repo_name="${PREFIX}-${_app_name}-state"
    clone-repo  "$repo_name" "$_pat_username" "$_pat_password" "$_org"
}

function clone-src-only-repo() {
    set -euo pipefail

    local _org="$1"
    local _pat_username="$3"
    local _pat_password="$4"
    local _app_name="$5"

    # clone clone application state/source repos
    echo "Clonning src app with name: '$_app_name'"
    repo_name="${PREFIX}-${_app_name}-src"
    clone-repo  "$repo_name" "$_pat_username" "$_pat_password" "$_org"
}


#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

# shellcheck source=src/runtime/pipelines/application-management/scripts/git-utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/git-utils.sh"

function push-content-to-application-src-repo() {

    cp -R "$_ci_solutions/." .
    sed "s/%ORG%/$_org/; s/%REPO%/$app/; s/%PREFIX%/$_prefix/" < "$_ci_solutions/.github/CODEOWNERS" > CODEOWNERS

    git add -A
    git diff-index --quiet HEAD || git commit -a -m "Initial C12 Build Pipeline Import"
    git push -u origin master
    echo "$_app_src_repo_path - CI Scripts Pushed Successfully"
}

function hydrate-application-src-repos-actions() {

    # This variables gets injected automatically by github actions docker type, declaring locals just for clarity of the code.
    local _prefix="$PREFIX"
    local _org="$GITHUB_REPOSITORY_OWNER"
    local _checkout_path="$GITHUB_WORKSPACE/cloned_repos"
    local _ci_solutions="$GITHUB_WORKSPACE/.c12/components/ci-solutions"
    local _pat_username="$PAT_USERNAME"
    local _pat_password="$PAT_TOKEN"
    _application_names=$(get-application-list)
    local _git_email="$GIT_EMAIL"
    local _git_name="$GIT_NAME"

    if [[ "$_application_names" == "" ]]
    then
        echo "No applications found, nothing done"
        return 0
    fi

    git config --global user.email "$_git_email"
    git config --global user.name "$_git_name"

    for app in "${_application_names[@]}"; do
        cd "$_checkout_path"
        clone-src-only-repo "$_org" "$_prefix" "$_pat_username" "$_pat_password" "$app"
        _app_src_repo_path="$_checkout_path/$_prefix-$app-src"
        if [ ! -f "$_app_src_repo_path/.github/workflows/application-src-pipeline.yml" ] || [ ! -f "$_app_src_repo_path/CODEOWNERS" ] || [ ! -d "$_app_src_repo_path/.c12" ]; then
            echo "$_app_src_repo_path - CI Scripts Missing"
            cd "$_app_src_repo_path"
            push-content-to-application-src-repo
            cd ..
        fi
    done
}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    hydrate-application-src-repos-actions
fi


#!/usr/bin/env bash
# -*- coding: utf-8 -*-

function lint() {
    echo "lint app.yaml files"
  if [ "$1" ] && [ "$2" ]
  then
    docker run --mount src="$(pwd)",target=/mount-dir,type=bind stelligent/config-lint "$1" "$2"
    return 0
  else
    echo "No args.."
    echo "The program can also read files from a separate YAML file, and can scan these types of files:"
    return 1
  fi
}


#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

function push-docker-images() {

    # This variables are assigned by the workflow when running as an action, specified here as locals for clarity.
    local _org="$GITHUB_REPOSITORY_OWNER"
    local _prefix="$PREFIX"
    local _appplication_definitions_path="$GITHUB_WORKSPACE"
    local _cluster_definitions_path="$GITHUB_WORKSPACE/cloned_repos/$_prefix-cluster-management"
    local _application_names
    local _ci_acr_name="$CI_ACR_NAME"

    _application_names=$(get-application-list)

    _all_acr=$(az acr list -o json)
    _ci_acr_login_url=$(az acr list | jq -r ' .[] | select(.name == "'"$_ci_acr_name"'") | .loginServer' | tr -d "\n" )

    for _app_name in $_application_names
    do
        echo "Provisioning images for $_app_name"
        _app_definition_path="$_appplication_definitions_path"/"$_app_name".yaml
        for _deployment_group in $(yq -r '.spec."deployment-groups"[].name' "$_app_definition_path")
        do
            echo "Pushing images of $_deployment_group"
            _app_version=$(yq -r '.spec."deployment-groups"[]  | select(.name=="'"$_deployment_group"'") | .application.version ' "$_app_definition_path")
            if [[ "$_app_version" == "null" ]]
            then
                echo "Skipping image push of app $_app_name for deployment group $_deployment_group application version is null"
            else
                echo "Version for deployment group is $_app_version"
                source_image="$_ci_acr_login_url"/"$_org"/"$_prefix"-"$_app_name"-src:"$_app_version"

                for cluster in $(yq -r '.spec."deployment-groups"[]  | select(.name=="'"$_deployment_group"'") | .clusters[].name ' "$_app_definition_path")
                do
                    echo "Pushing $_app_name version: $_app_version to cluster: $cluster"
                    cluster_acr_registry_url=$(yq -r ' . | select(.metadata.name=="'"$cluster"'") | .spec.registry.docker.url' "$_cluster_definitions_path"/*.yaml | tr -d "\n")
                    cluster_acr_azure_name=$(echo "$_all_acr" | jq -r ' .[] | select( .loginServer == "'"$cluster_acr_registry_url"'") | .name' | tr -d "\n" )
                    echo "destination: ${cluster_acr_azure_name} source image: ${source_image}"
                    az acr import --force -n "${cluster_acr_azure_name}" --source "$source_image"
                done
            fi
        done
    done
}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    az_cli_sp_login
    push-docker-images
fi


#!/usr/bin/env bash

# shellcheck source=src/runtime/pipelines/application-management/scripts/utils.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/utils.sh"

# Reads all app.yaml and all the clusters.yaml and pushes the helm charts used by apps
# in the appropiate clusters, this version still does not support archetypes versions
function push_helm_chart_to_clusters() {

    # This variables are set by the github workflow when running the docker actions.
    local _prefix="$PREFIX"
    local _helm_username="$IMAGE_REPOSITORY_USERNAME"
    local _helm_password="$IMAGE_REPOSITORY_PASSWORD"
    local _ci_acr_name="$CI_ACR_NAME"

    repos_root="$GITHUB_WORKSPACE"
    cluster_definitions_path="$repos_root/cloned_repos/$_prefix-cluster-management"
    appplication_definitions_path="$repos_root"

    APP_LIST_JSON=$("$TOOLS_PATH"/chartextractor -a "$appplication_definitions_path" -c "$cluster_definitions_path")

    #Login in the source repository
    echo "Adding ci helm repository to local helm"
    helm repo add ci_acr https://"$_ci_acr_name".azurecr.io/helm/v1/repo --username "$_helm_username" --password "$_helm_password"

    # #Login in all required clusters helm registries, this is v2 OCI mode, hemloperator does not support it yet.
    # export HELM_EXPERIMENTAL_OCI=1
    # for clust in $(echo $JSON | jq -r 'flatten | unique | .[]')
    # do
    #     cluster_helm_repo_name="cluster_$clust"
    #     cluster_helm_repo=$(echo "$clusters_json" | jq -r ' . | select(.metadata.name=="'"$clust"'") | .spec.registry.helm.url' | tr -d "\n")
    #     echo "Login in $cluster_helm_repo"
    #     helm repo add "$cluster_helm_repo_name"  "$cluster_helm_repo" --username "$_helm_username" --password "$_helm_password"
    # done

    #Create a temp repository for all the charts
    local _temp_folder
    _temp_folder=$(mktemp -d)

    #Loop over all the different achetypes used by the clusters
    for arch in $(echo "$APP_LIST_JSON" | jq -r "keys | .[]");
    do
        echo "Pulling chart $arch from ci helm repository"
        helm pull ci_acr/"$arch" --destination "$_temp_folder"
        helm_chart_filename=$(find "$_temp_folder" -name "$arch*.tgz" | tr -d "\n")

        echo "Looking for all clusters where $arch is required ($helm_chart_filename)"

        #Go to each cluster where the archetype is required.
        for cluster in $(echo "$APP_LIST_JSON" | jq -r ".[\"$arch\"]? | .[]");
        do
            cluster_helm_repo=$(yq -r ' . | select(.metadata.name=="'"$cluster"'") | .spec.registry.helm.url' "$cluster_definitions_path"/*.yaml | tr -d "\n")
            echo "Cluster helm repository url: $cluster_helm_repo"
            acr_name=$(echo "$cluster_helm_repo" | grep --color=never -o -P '(?<=https://).*(?=\.azurecr\.io/helm/v1/repo)' | tr -d "\n")

            echo "pushing $arch to $cluster (using az cli to acr:$acr_name)"
            az acr helm push -n "$acr_name" "$helm_chart_filename" --force
        done
    done
}

set -euo pipefail

if [ -n "${GITHUB_ACTIONS+set}" ];
then
    az_cli_sp_login
    push_helm_chart_to_clusters
fi


#!/usr/bin/env bash

# fixes prefexes like E2E-AAD-Test -> e2eaadtestterraformstate which is needed to az storage names
# and trims to the max 24 chars limit ie MOREthank24CharPrexfi -> morethank24charprexfiter
function az_storage_normalize() {
    echo "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._]//g' | sed 's/$/terraformstate&/' | cut -c -24
}

# Terraform Init - intialise a tf template + Azure Blob storage on Github action agent
function terraform_init_gh() {

    # shellcheck disable=SC2155
    local _storage_account_name="$(az_storage_normalize "$PREFIX")"
    local _container_name="${PREFIX}-terraform-state-sac"
    local _container_rg="${PREFIX}-c12-rg"
    local _subscription_id="$ARM_SUBSCRIPTION_ID"

    terraform init \
        -backend-config "storage_account_name=$_storage_account_name" \
        -backend-config "container_name=$_container_name" \
        -backend-config "resource_group_name=$_container_rg" \
        -backend-config "subscription_id=$_subscription_id"
}


#!/usr/bin/env bash

TOOLS_PATH="/app"

function az_cli_sp_login(){
    echo "Login to azure with az cli"
    az login --service-principal --tenant "$ARM_TENANT_ID" --username "$ARM_CLIENT_ID" --password "$ARM_CLIENT_SECRET"
}

function get-application-list() {

    APP_LIST_JSON=$("${TOOLS_PATH}"/appsourceextractor -a "${GITHUB_WORKSPACE}")
    APP_LIST=$(echo "$APP_LIST_JSON" | tail -1 | jq -r '.[]')
    echo "$APP_LIST"
}

function get-application-list-json() {

    APP_LIST_JSON=$("${TOOLS_PATH}"/appsourceextractor -a "${GITHUB_WORKSPACE}")
    APP_LIST=$(echo "$APP_LIST_JSON" | tail -1 | jq -r '.')
    echo "$APP_LIST"
}


#!/usr/bin/env bash
# -*- coding: utf-8 -*-

# Builds images for each Dockerfile found recursively in the given directory.
# Resolves image dependencies for images in the same organization.
# Tags images based on the directory structure and git branch names.
#
# source ./image_build.sh
# Usage:image_build [Dockerfile|directory] [...]

# Normalizes according to docker hub organization/image naming conventions:
normalize() {
  echo "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]//g'
}

lowerize() {
  echo "$1" | tr '[:upper:]' '[:lower:]'
}

# Builds an image for each git branch of the given Dockerfile directory:
build_versions() {
  image="$1"
  # unset image var
  shift 1
  git_tag="$(git log -1 --format=%H)"
  docker build -t "$image:$git_tag" "$@" .
}

# Builds an image for each git branch of the given Dockerfile directory:
build() {
  cwd="$PWD"
  file="$(basename "$1")"
  dir="$(dirname "$1")"
  cd "$dir" || return 1
  organization="$ACR_IMAGE_URL"
  if [ -z "$organization" ]; then
    # Use the parent folder for the organization/user name:
    organization="$(cd ../.. && normalize "$(basename "$PWD")")"
  fi
  # Use the REPO_GITHUB env for the image name:
  image="$organization/$(lowerize "$REPO_GITHUB")"
  # Check if the image depends on another image of the same organization:
  echo -n "$IMAGE_REPOSITORY_PASSWORD" | docker login "$ACR_IMAGE_URL" --username "$IMAGE_REPOSITORY_USERNAME" --password-stdin
  # docker pull "$image"
  build_versions "$image" -f "$file"
  status=$?
  cd "$cwd" || return 1
  return $status
}

# Builds and tags images for each Dockerfile in the arguments list:
build_images() {
  for file; do
    # Shift the arguments list to remove the current Dockerfile:
    shift
    # Basic check if the file is a valid Dockerfile:
    if ! grep '^FROM ' "$file"; then
      echo "Invalid Dockerfile: $file" >&2
      continue
    else
      build "$file"
    fi
  done
}

NEWLINE='
'
# finds Dockerfiles and starts the builds:
find_dockerfiles() {
  dockerfiles_list=
  for arg; do
    if [ -d "$arg" ]; then
      # Search for Dockerfiles and add them to the list:
      dockerfiles_list="$dockerfiles_list$NEWLINE$(find "$arg" -name Dockerfile)"
    else
      dockerfiles_list="$dockerfiles_list$NEWLINE$arg"
    fi
  done
  # Set the list as arguments, splitting only at newlines:
  IFS="$NEWLINE";
  # shellcheck disable=SC2086
  set -- $dockerfiles_list;
  unset IFS
  build_images "$@"
}

function image_build () {
# Test if exactly 4 arguments are passed into the function
if [ -z "$ACR_IMAGE_URL" ]
then
  echo "Error: ACR_IMAGE_URL is not set"
  exit 1
fi
if [ -z "$IMAGE_REPOSITORY_USERNAME" ]
then
  echo "Error: IMAGE_REPOSITORY_USERNAME is not set"
  exit 1
fi

  if [ -z "$IMAGE_REPOSITORY_PASSWORD" ]
then
  echo "Error: IMAGE_REPOSITORY_PASSWORD is not set"
  exit 1
fi
  # finds Dockerfiles and starts the builds:
  find_dockerfiles "${@:-.}"
}

# Usage:image_build [Dockerfile|directory] [...]


#!/usr/bin/env bash
# -*- coding: utf-8 -*-

lowerize() {
    echo "$1" | tr '[:upper:]' '[:lower:]'
}

function image_publishing () {
    # Test if exactly four arguments are passed into the function
    if [[ $# -ne 2 ]];
    then
        echo "Error: Expecting 2 arguments for this function"
        exit 1
    fi
    # Validate existence of environment variables
    if [ -z "$IMAGE_REPOSITORY_USERNAME" ]
    then
    echo "Error: IMAGE_REPOSITORY_USERNAME is not set"
    exit 1
    fi

    if [ -z "$IMAGE_REPOSITORY_PASSWORD" ]
    then
    echo "Error: IMAGE_REPOSITORY_PASSWORD is not set"
    exit 1
    fi
    # Create variables for arguments
    ACR_IMAGE_URL="$1"
    APP_IMAGE_NAME="$2"
    # Log in to DEV ACR with service principal credentials
    echo -n "$IMAGE_REPOSITORY_PASSWORD" | docker login "$ACR_IMAGE_URL" --username "$IMAGE_REPOSITORY_USERNAME" --password-stdin
    docker push "$ACR_IMAGE_URL"/"$APP_IMAGE_NAME"
    docker logout "$ACR_IMAGE_URL"
}


#!/usr/bin/env bash
# -*- coding: utf-8 -*-

function image_scanning () {
    echo "Docker Image scanning"
    echo "$1"
    echo "$2"
    echo "$3"

}

function functional_test () {
    echo "functional_tests"
    echo "$1"
    echo "$2"
    echo "$3"

}

function integration_test () {
    echo "image integration tests"
    echo "$1"
    echo "$2"
    echo "$3"

}

function image_signing () {
    echo "image_signing"
    echo "$1"
    echo "$2"
    echo "$3"
}


#!/usr/bin/env bash
# -*- coding: utf-8 -*-

function lint() {
    echo "lint app.yaml files"
  if [ "$1" ] && [ "$2" ]
  then
    docker run --mount src="$(pwd)",target=/mount-dir,type=bind stelligent/config-lint "$1" "$2"
    return 0
  else
    echo "No args.."
    echo "The program can also read files from a separate YAML file, and can scan these types of files:"
    return 1
  fi
}

function compile () {
  echo "compile Example"
  case "$1" in
  "mvn")
      info "mvn clean install"
      exit 0
      ;;
  "go" | "gobuild")
      info "go build"
      exit 0
      ;;
  *)
      echo "Unknown Compile step \'$1\'"
      exit 1
      ;;
  esac
}

function unit_test () {
  echo "Unit Test Example"
  case "$1" in
  "mvn")
      info "mvn test-DskipITs=true"
      exit 0
      ;;
  "go" | "gotest")
      info "go test"
      exit 0
      ;;
  *)
      echo "Unknown test step \'$1\'"
      exit 1
      ;;
  esac
}

function integration_test () {
  echo "Integration Test Example"
  case "$1" in
  "mvn")
      info "mvn test -DskipITs=false"
      exit 0
      ;;
  "go" | "gotest")
      info "go test -run 'Integration'"
      exit 0
      ;;
  *)
      echo "Unknown integration test step \'$1\'"
      exit 1
      ;;
  esac
}

function code_scanning () {
  echo "code_scanning"

  if [ -z "$SONAR_HOST_URL" ]
	then
	  echo "SONAR_HOST_URL is not set"
	  exit 1
	fi

  if [ -z "$SONAR_TOKEN" ]
	then
		echo "SONAR_TOKEN is not set"
		exit 1
	fi

  if [ -z "$IMAGE_SONAR_SCANNER" ]
	then
		echo "IMAGE_SONAR_SCANNER is not set"
		exit 1
	fi

  if [ "$1" ]
  then
    docker run -e SONAR_HOST_URL="$SONAR_HOST_URL" -e SONAR_TOKEN="$SONAR_TOKEN" -e SONAR_PROJECT_BASE_DIR="$1" --user="$(id -u):$(id -g)" -it -v "$(PWD):/src" "$IMAGE_SONAR_SCANNER"
    return 0
  else
    echo "No args.."
    echo "The program can scan code with sonar-scanner-cli to a sonarqube instance specified, required Argument scanning dir path."
    return 1
  fi
}

function dependency_checks () {
  echo "dependency_checks"

  if [ -z "$IMAGE_DEPENDENCY_CHECK" ]
	  then
		  echo "IMAGE_DEPENDENCY_CHECK is not set"
		  exit 1
	fi

  if [ "$1" ]
  then
    docker run --rm --volume "$(pwd)":/src "$IMAGE_DEPENDENCY_CHECK" --scan "$1" --format "ALL" --out "$(pwd)/reports/dependency_checks/"
    echo "Reports Location: '$(pwd)'/reports/dependency_checks/"
    return 0
  else
    echo "No args.."
    echo "The program can scan code and dependency for OSWAP known vulnerabilities, required Arugment scanning dir path."
    return 1
  fi
}


#!/usr/bin/env bash

# shellcheck disable=SC2034
read -r -d '' __usage <<-'EOF' || true # exits non-zero when EOF encountered
  -f --file [arg]  Config Filename to use
EOF

# shellcheck source=src/runtime/bootstrap/lib/main.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && cd ../ && pwd)/runtime/bootstrap/lib/main.sh"

# shellcheck source=src/runtime/bootstrap/lib/ini_val.sh
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && cd ../ && pwd)/runtime/bootstrap/lib/ini_val.sh"

function ssh_tunnel() {

    config_file="$1"

    local_tunnel_port="1234"

    ssh_key_path=$(ini_val "$config_file" c12:generated.jumphost_ssh_key_location)
    ssh_host=$(ini_val "$config_file" c12:generated.jumphost_ip)
    ssh_username=$(ini_val "$config_file" c12:generated.jumphost_user)

    ssh -oStrictHostKeyChecking=no -l "$ssh_username" -i "$ssh_key_path" -L "$local_tunnel_port":127.0.0.1:8888 -C -N "$ssh_host" &

    echo "export HTTPS_PROXY=http://127.0.0.1:$local_tunnel_port && export https_proxy=http://127.0.0.1:$local_tunnel_port"
}

config_file="$arg_f"
ssh_tunnel "$config_file"


#!/usr/bin/env bash

export NO_COLOR="true"
export LOG_LEVEL=7


#!/bin/bash
BASE_PATH=./ironbank
BASE_IMAGE_ARCHIVE=$BASE_PATH/nodejs-12.16.tar
BASE_REPO_SERVER=ocpacr.azurecr.us
BASE_REPO_SERVER_USERNAME=[YOUR USERNAME]
BASE_REPO_SERVER_PASSWORD=[YOUR PASSWORD]
BASE_REPO=$BASE_REPO_SERVER/ironbank/opensource/nodejs/nodejs
BASE_TAG=12.16-development
APPLICATION_IMAGE=$BASE_REPO_SERVER/demo/hello-azure-gov:dev
APPLICATION_K8S_NAMESPACE=azure-gov-demo

RED='\033[0;31m'
GREEN='\033[0;32m'
BLUE='\033[0;34m'
HEADER=''
NC='\033[0m' # No Color

echo -e "\n\n${HEADER}Importing Iron Bank public key${NC}"
echo -e "----------------------------------------------------\n"
gpg --import $BASE_PATH/ironbank.asc

echo -e "\n\n${HEADER}Checking manifest using Iron Bank signature${NC}"
echo -e "----------------------------------------------------"

gpg --verify $BASE_PATH/signature.sig $BASE_PATH/manifest.json

echo -e  "\n\n${HEADER}Getting image checksum${NC}"
echo -e  "----------------------------------------------------"
EXPECTED_IMAGE_256_CHECKSUM=$(jq -r '.critical.image["image-tar-sha256-checksum"]' $BASE_PATH/manifest.json)
echo -e "Expected checksum is: " ${BLUE}${EXPECTED_IMAGE_256_CHECKSUM}${NC}
echo -e "Comparing against .tar file..."
ACTUAL_IMAGE_256_CHECKSUM=$(sha256sum $BASE_PATH/nodejs-12.16.tar)
echo -e "Actual checksum is:   " ${BLUE}${ACTUAL_IMAGE_256_CHECKSUM}${NC}
docker run -ti --rm mpepping/ponysay --colour "1;35" --pony spike checksums match!!
read

echo -e  "\n\n${HEADER}Loading, tagging, and pushing image${NC}"
echo -e  "----------------------------------------------------"
LOADED_IMAGE="$(docker load -i $BASE_IMAGE_ARCHIVE | awk '{print $3}')"
echo -e "Loaded image:" $LOADED_IMAGE
TARGET_IMAGE="${LOADED_IMAGE/localhost/$BASE_REPO_SERVER}"
echo -e "Target image:" ${GREEN} $TARGET_IMAGE ${NC}
echo -e "${BLUE}Retagging...${NC}"
docker tag $LOADED_IMAGE $TARGET_IMAGE
echo -e "${BLUE}Pushing " $TARGET_IMAGE ${NC}
docker push $TARGET_IMAGE
echo -e "${GREEN}Completed base image push!${NC}"

echo -e  "\n\n${HEADER}Build and push application image${NC}"
echo -e  "----------------------------------------------------"
echo -e "${BLUE}Building image...${NC}"
docker build -t $APPLICATION_IMAGE . >> /dev/null
echo -e ""
echo -e "${BLUE}Pushing image...${NC}"
docker push $APPLICATION_IMAGE
echo -e "${GREEN}Completed application image push!${NC}"

echo -e  "\n\n${HEADER}Deploy application image${NC}"
echo -e  "----------------------------------------------------"
kubectl create namespace $APPLICATION_K8S_NAMESPACE
kubectl create secret docker-registry ocpacr --docker-server=$BASE_REPO_SERVER --docker-username=$BASE_REPO_SERVER_USERNAME --docker-password=$BASE_REPO_SERVER_PASSWORD -n $APPLICATION_K8S_NAMESPACE

APPLICATION_IMAGE_HASH=$(docker inspect ${APPLICATION_IMAGE} | jq -r '.[0].RepoDigests[0]')
echo -e "${BLUE}Using Helm to deploy image with digest hash: ${APPLICATION_IMAGE_HASH##*@}${NC}"
helm install -n ${APPLICATION_K8S_NAMESPACE} hello-azure-gov ./charts/helloAzureGov --set image.sha=${APPLICATION_IMAGE_HASH##*@} --wait

sleep 5

echo -e  "\n\nPods${NC}"
echo -e  "----------------------------------------------------"
kubectl get pods -n $APPLICATION_K8S_NAMESPACE

echo -e  ""
docker run -ti --rm mpepping/ponysay --colour "0;32" --pony gummy Application ready: https://website.$APPLICATION_K8S_NAMESPACE.cloudfitdsop.com/


echo $(date) " - Starting Bastion Prep Script"

export USERNAME_ORG=${USERNAME_ORG}
export PASSWORD_ACT_KEY="${PASSWORD_ACT_KEY}"
export POOL_ID=${POOL_ID}
export SUDOUSER=${SUDOUSER}
export CUSTOMROUTINGCERTTYPE=${CUSTOMROUTINGCERTTYPE}
export CUSTOMMASTERCERTTYPE=${CUSTOMMASTERCERTTYPE}
export CUSTOMROUTINGCAFILE="${CUSTOMROUTINGCAFILE}"
export CUSTOMROUTINGCERTFILE="${CUSTOMROUTINGCERTFILE}"
export CUSTOMROUTINGKEYFILE="${CUSTOMROUTINGKEYFILE}"
export CUSTOMMASTERCAFILE="${CUSTOMMASTERCAFILE}"
export CUSTOMMASTERCERTFILE="${CUSTOMMASTERCERTFILE}"
export CUSTOMMASTERKEYFILE="${CUSTOMMASTERKEYFILE}"
export CUSTOMDOMAIN="${CUSTOMDOMAIN}"
export MINORVERSION=${MINORVERSION}
export CUSTOMMASTERTYPE=${CUSTOMMASTERTYPE}
export CUSTOMROUTINGTYPE=${CUSTOMROUTINGTYPE}
export REPOSERVER=${REPOSERVER}
export PRIVATEIP=${PRIVATEIP}
export ROUTERIP=${ROUTERIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRADNS=${INFRADNS}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}
export REGISTRYSERVER=${REGISTRYSERVER}

rm -f /etc/yum.repos.d/*.repo
sleep 10

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    # connected
    # Register Host with Cloud Access Subscription
    echo $(date) " - Register host with Cloud Access Subscription"

    subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
    RETCODE=$?

    if [ $RETCODE -eq 0 ]
    then
        echo "Subscribed successfully"
    elif [ $RETCODE -eq 64 ]
    then
        echo "This system is already registered."
    else
        echo "Incorrect Username / Password or Organization ID / Activation Key specified"
        exit 3
    fi

    subscription-manager attach --pool=${POOL_ID} > attach.log
    if [ $? -eq 0 ]
    then
        echo "Pool attached successfully"
    else
        grep attached attach.log
        if [ $? -eq 0 ]
        then
            echo "Pool ${POOL_ID} was already attached and was not attached again."
        else
            echo "Incorrect Pool ID or no entitlements available"
            exit 4
        fi
    fi

    # Disable all repositories and enable only the required ones
    echo $(date) " - Disabling all repositories and enabling only the required repos"

    subscription-manager repos --disable="*"

    subscription-manager repos \
        --enable="rhel-7-server-rpms" \
        --enable="rhel-7-server-extras-rpms" \
        --enable="rhel-7-server-ose-3.11-rpms" \
        --enable="rhel-7-server-ansible-2.6-rpms" \
        --enable="rhel-7-fast-datapath-rpms" \
        --enable="rh-gluster-3-client-for-rhel-7-server-rpms" \
        --enable="rhel-7-server-optional-rpms"
else

cat > /etc/yum.repos.d/ose.repo <<EOF
[rhel-7-repo]
name=rhel-7-repo
baseurl=http://${REPOSERVER}/repos
enabled=1
gpgcheck=0
EOF

fi

# Update system to latest packages
echo $(date) " - Update system to latest packages"
yum -y update --exclude=WALinuxAgent
echo $(date) " - System update complete"

# Install base packages and update system to latest packages
echo $(date) " - Install base packages"
yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion httpd-tools kexec-tools sos psacct ansible
yum -y update glusterfs-fuse
echo $(date) " - Base package installation complete"

# Install OpenShift utilities
echo $(date) " - Installing OpenShift utilities"
yum -y install openshift-ansible-3.11.${MINORVERSION}
echo $(date) " - OpenShift utilities installation complete"

# Install Docker
echo $(date) " - Installing Docker"
yum -y install docker

# Update docker config for insecure registry
rm -f /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
  "insecure-registries" : ["${REGISTRYSERVER}","docker-registry-default.${INFRADNS}"]
}
EOF

# Installing Azure CLI
# From https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-yum
echo $(date) " - Installing Azure CLI"
# sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
# sudo sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'
sudo yum install -y azure-cli
echo $(date) " - Azure CLI installation complete"

# Install ImageMagick to resize image for Custom Header
sudo yum install -y ImageMagick

# Configure DNS so it always has the domain name
echo $(date) " - Adding DOMAIN to search for resolv.conf"
if [[ "${CUSTOMDOMAIN}" == "none" ]]
then
	DOMAINNAME=`domainname -d`
else
	DOMAINNAME=${CUSTOMDOMAIN}
fi

echo "DOMAIN=${DOMAINNAME}" >> /etc/sysconfig/network-scripts/ifcfg-eth0

echo $(date) " - Restarting NetworkManager"
runuser -l ${SUDOUSER} -c "ansible localhost -o -b -m service -a \"name=NetworkManager state=restarted\""
echo $(date) " - NetworkManager configuration complete"

# Run Ansible Playbook to update ansible.cfg file
echo $(date) " - Updating ansible.cfg file"
if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 -t 5 https://raw.githubusercontent.com/microsoft/openshift-container-platform-playbooks/master/updateansiblecfg.yaml
    ansible-playbook -f 10 ./updateansiblecfg.yaml
else
    wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 -t 5 http://${SCRIPTSLOCATION}/ocpp/updateansiblecfg.yaml
    ansible-playbook -f 10 ./ocpp/updateansiblecfg.yaml
fi

# Create certificate files

if [[ "${CUSTOMMASTERCERTTYPE}" == "custom" ]]
then
    echo $(date) " - Creating custom master certificate files"
    runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERCAFILE}\" > /tmp/masterca.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERCERTFILE}\" > /tmp/mastercert.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERKEYFILE}\" > /tmp/masterkey.pem"
	echo $(date) " - Custom master certificate files masterca.pem, mastercert.pem, masterkey.pem created in /tmp"
fi

if [ "${CUSTOMROUTINGCERTTYPE}" == "custom" ]
then
    echo $(date) " - Creating custom routing certificate files"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGCAFILE}\" > /tmp/routingca.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGCERTFILE}\" > /tmp/routingcert.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGKEYFILE}\" > /tmp/routingkey.pem"
	echo $(date) " - Custom routing certificate files routingca.pem, routingcert.pem, routingkey.pem created in /tmp"
fi

# Add DNS host entries for cluster naming
cat >> /etc/hosts <<EOF
${PRIVATEIP} ${PRIVATEDNS}
${ROUTERIP} ${INFRADNS}
EOF

echo $(date) " - Script Complete"


echo $(date) " - Starting Script"

set -e

export SUDOUSER=${SUDOUSER}
export PASSWORD=${PASSWORD}
export MASTER=${MASTER}
export MASTERPUBLICIPHOSTNAME=${MASTERPUBLICIPHOSTNAME}
export MASTERPUBLICIPADDRESS=${MASTERPUBLICIPADDRESS}
export INFRA=${INFRA}
export NODE=${NODE}
export NODECOUNT=${NODECOUNT}
export INFRACOUNT=${INFRACOUNT}
export MASTERCOUNT=${MASTERCOUNT}
export ROUTING=${ROUTING}
export REGISTRYSA=${REGISTRYSA}
export ACCOUNTKEY=${ACCOUNTKEY}
export METRICS=${METRICS}
export LOGGING=${LOGGING}
export TENANTID=${TENANTID}
export SUBSCRIPTIONID=${SUBSCRIPTIONID}
export AADCLIENTID=${AADCLIENTID}
export AADCLIENTSECRET=${AADCLIENTSECRET}
export RESOURCEGROUP=${RESOURCEGROUP}
export LOCATION=${LOCATION}
export AZURE=${AZURE}
export STORAGEKIND=${STORAGEKIND}
export ENABLECNS=${ENABLECNS}
export CNS=${CNS}
export CNSCOUNT=${CNSCOUNT}
export VNETNAME=${VNETNAME}
export NODENSG=${NODENSG}
export NODEAVAILIBILITYSET=${NODEAVAILIBILITYSET}
export MASTERCLUSTERTYPE=${MASTERCLUSTERTYPE}
export PRIVATEIP=${PRIVATEIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRAPIPNAME=${INFRAPIPNAME}
export CUSTOMROUTINGCERTTYPE=${CUSTOMROUTINGCERTTYPE}
export CUSTOMMASTERCERTTYPE=${CUSTOMMASTERCERTTYPE}
export MINORVERSION=${MINORVERSION}
export REPOSERVER=${REPOSERVER}
export REGISTRYSERVER=${REGISTRYSERVER}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}
export DOCKERREGISTRYREALM=${DOCKERREGISTRYREALM}
export BASTION=$(hostname)

# Set CNS to default storage type.  Will be overridden later if Azure is true
export CNS_DEFAULT_STORAGE=true

# Setting DOMAIN variable
export DOMAIN=`domainname -d`

# Determine if Commercial Azure or Azure Government
# CLOUD=$( curl -H Metadata:true "http://169.254.169.254/metadata/instance/compute/location?api-version=2017-04-02&format=text" | cut -c 1-2 )
export CLOUD=${CLOUD^^}
# export CLOUDNAME="AzureUSGovernmentCloud"
# export CLOUDNAME="AzurePublicCloud"

export MASTERLOOP=$((MASTERCOUNT - 1))
export INFRALOOP=$((INFRACOUNT - 1))
export NODELOOP=$((NODECOUNT - 1))

echo $(date) " - Configuring SSH ControlPath to use shorter path name"

sed -i -e "s/^# control_path = %(directory)s\/%%h-%%r/control_path = %(directory)s\/%%h-%%r/" /etc/ansible/ansible.cfg
sed -i -e "s/^#host_key_checking = False/host_key_checking = False/" /etc/ansible/ansible.cfg
sed -i -e "s/^#pty=False/pty=False/" /etc/ansible/ansible.cfg
sed -i -e "s/^#stdout_callback = skippy/stdout_callback = skippy/" /etc/ansible/ansible.cfg
sed -i -e "s/^#pipelining = False/pipelining = True/" /etc/ansible/ansible.cfg

# echo $(date) " - Modifying sudoers"
sed -i -e "s/Defaults    requiretty/# Defaults    requiretty/" /etc/sudoers
sed -i -e '/Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"/aDefaults    env_keep += "PATH"' /etc/sudoers

# Setting the default openshift_cloudprovider_kind if Azure enabled
if [[ ${AZURE} == "true" ]]
then
    CLOUDKIND="openshift_cloudprovider_kind=azure
openshift_cloudprovider_azure_client_id=${AADCLIENTID}
openshift_cloudprovider_azure_client_secret=${AADCLIENTSECRET}
openshift_cloudprovider_azure_tenant_id=${TENANTID}
openshift_cloudprovider_azure_subscription_id=${SUBSCRIPTIONID}
openshift_cloudprovider_azure_cloud=${CLOUDNAME}
openshift_cloudprovider_azure_vnet_name=${VNETNAME}
openshift_cloudprovider_azure_security_group_name=${NODENSG}
openshift_cloudprovider_azure_availability_set_name=${NODEAVAILIBILITYSET}
openshift_cloudprovider_azure_resource_group=${RESOURCEGROUP}
openshift_cloudprovider_azure_location=${LOCATION}"
	CNS_DEFAULT_STORAGE=false
	if [[ ${STORAGEKIND} == "managed" ]]
	then
		SCKIND="openshift_storageclass_parameters={'kind': 'managed', 'storageaccounttype': 'Premium_LRS'}"
	else
		SCKIND="openshift_storageclass_parameters={'kind': 'shared', 'storageaccounttype': 'Premium_LRS'}"
	fi
fi

# Cloning Ansible playbook repository

echo $(date) " - Cloning Ansible playbook repository"

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    #Connected use this:
    ((cd /home/${SUDOUSER} && git clone https://github.com/Microsoft/openshift-container-platform-playbooks.git) || (cd /home/${SUDOUSER}/openshift-container-platform-playbooks && git pull))
else
    #Disconnected use this:
    cd /home/${SUDOUSER} && wget -r -np ${REPOSERVER}/ocpp/
    [ -d /home/${SUDOUSER}/openshift-container-platform-playbooks ] && rm -rf /home/${SUDOUSER}/openshift-container-platform-playbooks
    mv /home/${SUDOUSER}/${REPOSERVER}/ocpp /home/${SUDOUSER}/openshift-container-platform-playbooks
    [ -d /home/${SUDOUSER}/${REPOSERVER} ] && rm -rf /home/${SUDOUSER}/${REPOSERVER}
    cd /home/${SUDOUSER}/openshift-container-platform-playbooks
fi

if [ -d /home/${SUDOUSER}/openshift-container-platform-playbooks ]
then
    echo " - Retrieved playbooks successfully"
else
    echo " - Retrieval of playbooks failed"
    exit 7
fi

# Configure custom routing certificate
echo $(date) " - Create variable for routing certificate based on certificate type"
if [[ ${CUSTOMROUTINGCERTTYPE} == "custom" ]]
then
	ROUTINGCERTIFICATE="openshift_hosted_router_certificate={\"cafile\": \"/tmp/routingca.pem\", \"certfile\": \"/tmp/routingcert.pem\", \"keyfile\": \"/tmp/routingkey.pem\"}"
else
	ROUTINGCERTIFICATE=""
fi

# Configure master cluster address information based on Cluster type (private or public)
echo $(date) " - Create variable for master cluster address based on cluster type"
if [[ ${MASTERCLUSTERTYPE} == "private" ]]
then
    MASTERCLUSTERHOSTNAME=${PRIVATEDNS}
	MASTERCLUSTERADDRESS="openshift_master_cluster_hostname=${MASTER}-001v
openshift_master_cluster_public_hostname=${PRIVATEDNS}
openshift_master_cluster_public_vip=${PRIVATEIP}"
else
    MASTERCLUSTERHOSTNAME=${MASTERPUBLICIPHOSTNAME}
	MASTERCLUSTERADDRESS="openshift_master_cluster_hostname=${MASTERPUBLICIPHOSTNAME}
openshift_master_cluster_public_hostname=${MASTERPUBLICIPHOSTNAME}
openshift_master_cluster_public_vip=${MASTERPUBLICIPADDRESS}"
fi

# Configure custom master API certificate
echo $(date) " - Create variable for master api certificate based on certificate type"
if [[ ${CUSTOMMASTERCERTTYPE} == "custom" ]]
then
	MASTERCERTIFICATE="openshift_master_overwrite_named_certificates=true
openshift_master_named_certificates=[{\"names\": [\"${MASTERCLUSTERHOSTNAME}\"], \"cafile\": \"/tmp/masterca.pem\", \"certfile\": \"/tmp/mastercert.pem\", \"keyfile\": \"/tmp/masterkey.pem\"}]"
else
	MASTERCERTIFICATE=""
fi

# Create Master nodes grouping
echo $(date) " - Creating Master nodes grouping"
MASTERLIST="00${MASTERCOUNT}"
for c in $(seq -f "%03g" 1 ${MASTERCOUNT})
do
    mastergroup="$mastergroup
${MASTER}-${c}v openshift_node_group_name='node-config-master'"
done

# Create Infra nodes grouping
echo $(date) " - Creating Infra nodes grouping"
for c in $(seq -f "%03g" 1 ${INFRACOUNT})
do
    infragroup="$infragroup
${INFRA}-${c}v openshift_node_group_name='node-config-infra'"
done

# Create Nodes grouping
echo $(date) " - Creating Nodes grouping"
for c in $(seq -f "%03g" 1 ${NODECOUNT})
do
    nodegroup="$nodegroup
${NODE}-${c}v openshift_node_group_name='node-config-compute'"
done

# Create CNS nodes grouping if CNS is enabled
if [[ ${ENABLECNS} == "true" ]]
then
    echo $(date) " - Creating CNS nodes grouping"

    for c in $(seq -f "%03g" 1 ${CNSCOUNT})
    do
        cnsgroup="$cnsgroup
${CNS}-${c}v openshift_node_group_name='node-config-compute'"
    done
fi

# Setting the HA Mode if more than one master
if [ ${MASTERCOUNT} != 1 ]
then
	echo $(date) " - Enabling HA mode for masters"
    export HAMODE="openshift_master_cluster_method=native"
fi

# Create Temp Ansible Hosts File
echo $(date) " - Create Ansible Hosts file"

cat > /etc/ansible/hosts <<EOF
[tempnodes]
$mastergroup
$infragroup
$nodegroup
$cnsgroup
EOF

# Run a loop playbook to ensure DNS Hostname resolution is working prior to continuing with script
echo $(date) " - Running DNS Hostname resolution check"
runuser -l ${SUDOUSER} -c "ansible-playbook ~/openshift-container-platform-playbooks/check-dns-host-name-resolution.yaml"

# Create glusterfs configuration if CNS is enabled
if [[ ${ENABLECNS} == "true" ]]
then
    echo $(date) " - Creating glusterfs configuration"

	# Ensuring selinux is configured properly
    echo $(date) " - Setting selinux to allow gluster-fuse access"
    runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -a 'sudo setsebool -P virt_sandbox_use_fusefs on'" || true
	runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -a 'sudo setsebool -P virt_use_fusefs on'" || true

    for c in $(seq -f "%03g" 1 ${CNSCOUNT})
    do
        runuser ${SUDOUSER} -c "ssh-keyscan -H ${CNS}-${c}v >> ~/.ssh/known_hosts"
        drive=$(runuser ${SUDOUSER} -c "ssh ${CNS}-${c}v 'sudo /usr/sbin/fdisk -l'" | awk '$1 == "Disk" && $2 ~ /^\// && ! /mapper/ {if (drive) print drive; drive = $2; sub(":", "", drive);} drive && /^\// {drive = ""} END {if (drive) print drive;}')
        drive1=$(echo $drive | cut -d ' ' -f 1)
        drive2=$(echo $drive | cut -d ' ' -f 2)
        drive3=$(echo $drive | cut -d ' ' -f 3)
        cnsglusterinfo="$cnsglusterinfo
${CNS}-${c}v glusterfs_devices='[ \"${drive1}\", \"${drive2}\", \"${drive3}\" ]'"
    done

    HOSTEDREGISTRYVALS="openshift_hosted_registry_storage_kind=glusterfs
openshift_hosted_registry_storage_volume_size=20Gi
openshift_hosted_registry_selector='node-role.kubernetes.io/infra=true'"

else

    HOSTEDREGISTRYVALS="openshift_hosted_registry_storage_kind=object
openshift_hosted_registry_storage_provider=azure_blob
openshift_hosted_registry_storage_azure_blob_accountname=${REGISTRYSA}
openshift_hosted_registry_storage_azure_blob_accountkey=${ACCOUNTKEY}
openshift_hosted_registry_storage_azure_blob_container=registry
openshift_hosted_registry_storage_azure_blob_realm=$DOCKERREGISTRYREALM"

fi

# Create Ansible Hosts File
echo $(date) " - Create Ansible Hosts file"

cat > /etc/ansible/hosts <<EOF
# Create an OSEv3 group that contains the masters and nodes groups
[OSEv3:children]
masters
nodes
etcd
master0
glusterfs
glusterfs_registry
new_nodes

# Set variables common for all OSEv3 hosts
[OSEv3:vars]
ansible_ssh_user=${SUDOUSER}
ansible_become=yes
openshift_install_examples=true
deployment_type=openshift-enterprise
openshift_release=v3.11
openshift_image_tag=v3.11.${MINORVERSION}
openshift_pkg_version=-3.11.${MINORVERSION}
docker_udev_workaround=True
openshift_use_dnsmasq=true
openshift_master_default_subdomain=${ROUTING}
openshift_override_hostname_check=true
osm_use_cockpit=true
os_sdn_network_plugin_name='redhat/openshift-ovs-multitenant'
openshift_master_api_port=443
openshift_master_console_port=443
osm_default_node_selector='node-role.kubernetes.io/compute=true'
openshift_disable_check=memory_availability,docker_image_availability
$CLOUDKIND
$SCKIND
$CUSTOMCSS
$ROUTINGCERTIFICATE
$MASTERCERTIFICATE
$PROXY

# Workaround for docker image failure
# https://access.redhat.com/solutions/3480921
oreg_url=${REGISTRYSERVER}/openshift3/ose-\${component}:\${version}
openshift_examples_modify_imagestreams=true

# default selectors for router and registry services
openshift_router_selector='node-role.kubernetes.io/infra=true'
openshift_registry_selector='node-role.kubernetes.io/infra=true'

# Configure registry not to use Azure blob storage
openshift_hosted_registry_replicas=1
$HOSTEDREGISTRYVALS

# Deploy Service Catalog
openshift_enable_service_catalog=false

# Type of clustering being used by OCP
$HAMODE

# Addresses for connecting to the OpenShift master nodes
$MASTERCLUSTERADDRESS

# Enable HTPasswdPasswordIdentityProvider
openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true', 'challenge': 'true', 'kind': 'HTPasswdPasswordIdentityProvider'}]

# Specify CNS images
openshift_storage_glusterfs_image=${REGISTRYSERVER}/rhgs3/rhgs-server-rhel7:v3.11
openshift_storage_glusterfs_block_image=${REGISTRYSERVER}/rhgs3/rhgs-gluster-block-prov-rhel7:v3.11
openshift_storage_glusterfs_s3_image=${REGISTRYSERVER}/rhgs3/rhgs-s3-server-rhel7:v3.11
openshift_storage_glusterfs_heketi_image=${REGISTRYSERVER}/rhgs3/rhgs-volmanager-rhel7:v3.11

# Setup metrics
openshift_metrics_install_metrics=$METRICS
openshift_metrics_start_cluster=$METRICS
openshift_metrics_hawkular_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_metrics_cassandra_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_metrics_heapster_nodeselector={"node-role.kubernetes.io/infra":"true"}

# Setup logging
openshift_logging_install_logging=$LOGGING
openshift_logging_fluentd_nodeselector={"logging":"true"}
openshift_logging_es_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_kibana_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_curator_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_master_public_url=https://${MASTERCLUSTERHOSTNAME}

# host group for masters
[masters]
${MASTER}-[001:${MASTERLIST}]v

# host group for etcd
[etcd]
${MASTER}-[001:${MASTERLIST}]v

[master0]
${MASTER}-001v

# Only populated when CNS is enabled
[glusterfs]
$cnsglusterinfo

[glusterfs_registry]
$cnsglusterinfo

# host group for nodes
[nodes]
$mastergroup
$infragroup
$nodegroup
$cnsgroup

# host group for adding new nodes
[new_nodes]
EOF

# Update WALinuxAgent
echo $(date) " - Updating WALinuxAgent on all cluster nodes"
runuser ${SUDOUSER} -c "ansible all -f 30 -b -m yum -a 'name=WALinuxAgent state=latest'"

# Setup NetworkManager to manage eth0
echo $(date) " - Running NetworkManager playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-node/network_manager.yml"

# Configure DNS so it always has the domain name
echo $(date) " - Adding $DOMAIN to search for resolv.conf"
runuser ${SUDOUSER} -c "ansible all -o -f 30 -b -m lineinfile -a 'dest=/etc/sysconfig/network-scripts/ifcfg-eth0 line=\"DOMAIN=$DOMAIN\"'"

# Configure resolv.conf on all hosts through NetworkManager
echo $(date) " - Restarting NetworkManager"
runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -m service -a \"name=NetworkManager state=restarted\""
echo $(date) " - NetworkManager configuration complete"

# Restarting things so everything is clean before continuing with installation
echo $(date) " - Rebooting cluster to complete installation"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/reboot-master.yaml"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/reboot-nodes.yaml"
sleep 20

# Run OpenShift Container Platform prerequisites playbook
echo $(date) " - Running Prerequisites via Ansible Playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/prerequisites.yml"
echo $(date) " - Prerequisites check complete"

# Initiating installation of OpenShift Container Platform using Ansible Playbook
echo $(date) " - Installing OpenShift Container Platform via Ansible Playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/deploy_cluster.yml"
if [ $? -eq 0 ]
then
    echo $(date) " - OpenShift Cluster installed successfully"
else
    echo $(date) " - OpenShift Cluster failed to install"
    exit 6
fi

# Install OpenShift Atomic Client
cd /root
mkdir .kube
runuser ${SUDOUSER} -c "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${SUDOUSER}@${MASTER}-001v:~/.kube/config /tmp/kube-config"
cp /tmp/kube-config /root/.kube/config
mkdir /home/${SUDOUSER}/.kube
cp /tmp/kube-config /home/${SUDOUSER}/.kube/config
chown --recursive ${SUDOUSER} /home/${SUDOUSER}/.kube
rm -f /tmp/kube-config
yum -y install atomic-openshift-clients

# Adding user to OpenShift authentication file
echo $(date) " - Adding OpenShift user"
runuser ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/addocpuser.yaml"

# Assigning cluster admin rights to OpenShift user
echo $(date) " - Assigning cluster admin rights to user"
runuser ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/assignclusteradminrights.yaml"

# Installing Service Catalog, Ansible Service Broker and Template Service Broker
if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
then
    runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_enable_service_catalog=true -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-service-catalog/config.yml"
fi

# Adding Open Sevice Broker for Azaure (requires service catalog)
# Disabling deployment of OSBA
if [[ ${AZURE} == "true" ]]
then
    oc new-project osba
    oc process -f https://raw.githubusercontent.com/Azure/open-service-broker-azure/master/contrib/openshift/osba-os-template.yaml  \
        -p ENVIRONMENT=AzurePublicCloud \
        -p AZURE_SUBSCRIPTION_ID=${SUBSCRIPTIONID} \
        -p AZURE_TENANT_ID=${TENANTID} \
        -p AZURE_CLIENT_ID=${AADCLIENTID} \
        -p AZURE_CLIENT_SECRET=${AADCLIENTSECRET} \
        | oc create -f -
fi

# Configure Metrics
if [[ ${METRICS} == "true" ]]
then
    sleep 30
    echo $(date) "- Deploying Metrics"
    if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
    then
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_metrics_install_metrics=True -e openshift_metrics_cassandra_storage_type=dynamic -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-metrics/config.yml"
    else
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_metrics_install_metrics=True /usr/share/ansible/openshift-ansible/playbooks/openshift-metrics/config.yml"
    fi
    if [ $? -eq 0 ]
    then
        echo $(date) " - Metrics configuration completed successfully"
    else
        echo $(date) " - Metrics configuration failed"
        exit 11
    fi
fi

# Configure Logging

if [[ ${LOGGING} == "true" ]]
then
    sleep 60
    echo $(date) "- Deploying Logging"
    if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
    then
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_logging_install_logging=True -e openshift_logging_es_pvc_dynamic=true -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-logging/config.yml"
    else
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_logging_install_logging=True -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-logging/config.yml"
    fi
    if [ $? -eq 0 ]
    then
        echo $(date) " - Logging configuration completed successfully"
    else
        echo $(date) " - Logging configuration failed"
        exit 12
    fi
fi

if [[ ${AZURE} == "true" ]]
then
    # Creating variables file for private master and Azure AD configuration playbook
    echo $(date) " - Creating variables file for future playbooks"
cat > /home/${SUDOUSER}/openshift-container-platform-playbooks/vars.yaml <<EOF
admin_user: $SUDOUSER
master_lb_private_dns: $PRIVATEDNS
domain: $DOMAIN
EOF

    # Configure cluster for private masters
    if [[ ${MASTERCLUSTERTYPE} == "private" ]]
    then
        echo $(date) " - Configure cluster for private masters"
        runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/activate-private-lb-fqdn.31x.yaml"
    fi
fi

# Delete yaml files
echo $(date) " - Deleting unecessary files"
rm -rf /home/${SUDOUSER}/openshift-container-platform-playbooks

# Delete pem files
echo $(date) " - Delete pem files"
rm -rf /tmp/*.pem

echo $(date) " - Sleep for 15 seconds"
sleep 15

echo $(date) " - Script complete"

# *.apps.beta-openshift.com == 10.3.101.200
# *.console.beta-openshift.com == 10.3.101.100

# address=/console.dev-openshift.com/10.3.104.100
# address=/apps.dev-openshift.com/10.3.104.200


echo $(date) " - Starting Node Prep Script"

export USERNAME_ORG=${USERNAME_ORG}
export PASSWORD_ACT_KEY=${PASSWORD_ACT_KEY}
export POOL_ID=${POOL_ID}
export REPOSERVER=${REPOSERVER}
export REGISTRYSERVER=${REGISTRYSERVER}
export PRIVATEIP=${PRIVATEIP}
export ROUTERIP=${ROUTERIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRADNS=${INFRADNS}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}

# Remove RHUI

rm -f /etc/yum.repos.d/*.repo
sleep 10

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    # connected
    # Register Host with Cloud Access Subscription
    echo $(date) " - Register host with Cloud Access Subscription"

    subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
    RETCODE=$?

    if [ $RETCODE -eq 0 ]
    then
        echo "Subscribed successfully"
    elif [ $RETCODE -eq 64 ]
    then
        echo "This system is already registered."
    else
    sleep 5
        subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
        RETCODE2=$?
        if [ $RETCODE2 -eq 0 ]
        then
            echo "Subscribed successfully"
        elif [ $RETCODE2 -eq 64 ]
        then
            echo "This system is already registered."
        else
            echo "Incorrect Username / Password or Organization ID / Activation Key specified. Unregistering system from RHSM"
            subscription-manager unregister
            exit 3
        fi
    fi

    subscription-manager attach --pool=${POOL_ID} > attach.log
    if [ $? -eq 0 ]
    then
    echo "Pool attached successfully"
    else
    grep attached attach.log
    if [ $? -eq 0 ]
    then
        echo "Pool ${POOL_ID} was already attached and was not attached again."
    else
        echo "Incorrect Pool ID or no entitlements available"
        exit 4
    fi
    fi

    # Disable all repositories and enable only the required ones
    echo $(date) " - Disabling all repositories and enabling only the required repos"

    subscription-manager repos --disable="*"

    subscription-manager repos \
        --enable="rhel-7-server-rpms" \
        --enable="rhel-7-server-extras-rpms" \
        --enable="rhel-7-server-ose-3.11-rpms" \
        --enable="rhel-7-server-ansible-2.6-rpms" \
        --enable="rhel-7-fast-datapath-rpms" \
        --enable="rh-gluster-3-client-for-rhel-7-server-rpms" \
        --enable="rhel-7-server-optional-rpms"
else

cat > /etc/yum.repos.d/ose.repo <<EOF
[rhel-7-repo]
name=rhel-7-repo
baseurl=http://${REPOSERVER}/repos
enabled=1
gpgcheck=0
EOF

fi

# Install base packages and update system to latest packages
echo $(date) " - Install base packages and update system to latest packages"

yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion kexec-tools sos psacct
yum -y install cloud-utils-growpart.noarch
yum -y install ansible
yum -y update glusterfs-fuse
yum -y update --exclude=WALinuxAgent
echo $(date) " - Base package insallation and updates complete"

# Grow Root File System
echo $(date) " - Grow Root FS"

rootdev=`findmnt --target / -o SOURCE -n`
rootdrivename=`lsblk -no pkname $rootdev`
rootdrive="/dev/"$rootdrivename
name=`lsblk  $rootdev -o NAME | tail -1`
part_number=${name#*${rootdrivename}}

growpart $rootdrive $part_number -u on
xfs_growfs $rootdev

# Install Docker
echo $(date) " - Installing Docker"
yum -y install docker

# Update docker config for insecure registry
rm -f /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
  "insecure-registries" : ["${REGISTRYSERVER}","docker-registry-default.${INFRADNS}"]
}
EOF

# Create thin pool logical volume for Docker
echo $(date) " - Creating thin pool logical volume for Docker and starting service"

DOCKERVG=$( parted -m /dev/sda print all 2>/dev/null | grep unknown | grep /dev/sd | cut -d':' -f1 | head -n1 )

echo "
# Adding OpenShift data disk for docker
DEVS=${DOCKERVG}
VG=docker-vg
" >> /etc/sysconfig/docker-storage-setup

# Running setup for docker storage
docker-storage-setup
if [ $? -eq 0 ]
then
    echo "Docker thin pool logical volume created successfully"
else
    echo "Error creating logical volume for Docker"
    exit 5
fi

# Enable and start Docker services

systemctl enable docker
systemctl start docker

# Add DNS host entries for cluster naming
cat >> /etc/hosts <<EOF
${PRIVATEIP} ${PRIVATEDNS}
${ROUTERIP} ${INFRADNS}
EOF

echo $(date) " - Script Complete"


echo $(date) " - Starting Master Prep Script"

export USERNAME_ORG=${USERNAME_ORG}
export PASSWORD_ACT_KEY=${PASSWORD_ACT_KEY}
export POOL_ID=${POOL_ID}
export REPOSERVER=${REPOSERVER}
export REGISTRYSERVER=${REGISTRYSERVER}
export PRIVATEIP=${PRIVATEIP}
export ROUTERIP=${ROUTERIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRADNS=${INFRADNS}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}

# Remove RHUI

rm -f /etc/yum.repos.d/*.repo
sleep 10

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    # connected
    # Register Host with Cloud Access Subscription
    echo $(date) " - Register host with Cloud Access Subscription"

    subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
    RETCODE=$?

    if [ $RETCODE -eq 0 ]
    then
        echo "Subscribed successfully"
    elif [ $RETCODE -eq 64 ]
    then
        echo "This system is already registered."
    else
        sleep 5
        subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
        RETCODE2=$?
        if [ $RETCODE2 -eq 0 ]
        then
            echo "Subscribed successfully"
        elif [ $RETCODE2 -eq 64 ]
        then
            echo "This system is already registered."
        else
            echo "Incorrect Username / Password or Organization ID / Activation Key specified. Unregistering system from RHSM"
            subscription-manager unregister
            exit 3
        fi
    fi

    subscription-manager attach --pool=${POOL_ID} > attach.log
    if [ $? -eq 0 ]
    then
        echo "Pool attached successfully"
    else
        grep attached attach.log
        if [ $? -eq 0 ]
        then
            echo "Pool ${POOL_ID} was already attached and was not attached again."
        else
            echo "Incorrect Pool ID or no entitlements available"
            exit 4
    fi
    fi

    # Disable all repositories and enable only the required ones
    echo $(date) " - Disabling all repositories and enabling only the required repos"

    subscription-manager repos --disable="*"

    subscription-manager repos \
        --enable="rhel-7-server-rpms" \
        --enable="rhel-7-server-extras-rpms" \
        --enable="rhel-7-server-ose-3.11-rpms" \
        --enable="rhel-7-server-ansible-2.6-rpms" \
        --enable="rhel-7-fast-datapath-rpms" \
        --enable="rh-gluster-3-client-for-rhel-7-server-rpms" \
        --enable="rhel-7-server-optional-rpms"
else

cat > /etc/yum.repos.d/ose.repo <<EOF
[rhel-7-repo]
name=rhel-7-repo
baseurl=http://${REPOSERVER}/repos
enabled=1
gpgcheck=0
EOF

fi

# Install base packages and update system to latest packages
echo $(date) " - Install base packages and update system to latest packages"

yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion httpd-tools kexec-tools sos psacct ansible

yum -y install cloud-utils-growpart.noarch
yum -y update glusterfs-fuse
yum -y update --exclude=WALinuxAgent
echo $(date) " - Base package insallation and updates complete"

# Grow Root File System
echo $(date) " - Grow Root FS"

rootdev=`findmnt --target / -o SOURCE -n`
rootdrivename=`lsblk -no pkname $rootdev`
rootdrive="/dev/"$rootdrivename
name=`lsblk  $rootdev -o NAME | tail -1`
part_number=${name#*${rootdrivename}}

growpart $rootdrive $part_number -u on
xfs_growfs $rootdev

if [ $? -eq 0 ]
then
    echo "Root partition expanded"
else
    echo "Root partition failed to expand"
    exit 6
fi

# Install Docker
echo $(date) " - Installing Docker"
yum -y install docker

# Update docker config for insecure registry
rm -f /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
  "insecure-registries" : ["${REGISTRYSERVER}","docker-registry-default.${INFRADNS}"]
}
EOF

# Create thin pool logical volume for Docker
echo $(date) " - Creating thin pool logical volume for Docker and staring service"

DOCKERVG=$( parted -m /dev/sda print all 2>/dev/null | grep unknown | grep /dev/sd | cut -d':' -f1 )

echo "
# Adding OpenShift data disk for docker
DEVS=${DOCKERVG}
VG=docker-vg
" >> /etc/sysconfig/docker-storage-setup

# Running setup for docker storage
docker-storage-setup
if [ $? -eq 0 ]
then
   echo "Docker thin pool logical volume created successfully"
else
   echo "Error creating logical volume for Docker"
   exit 5
fi

# Enable and start Docker services
sysctl -w vm.max_map_count=262144

systemctl enable docker
systemctl start docker

# Add DNS host entries for cluster naming
cat >> /etc/hosts <<EOF
${PRIVATEIP} ${PRIVATEDNS}
${ROUTERIP} ${INFRADNS}
EOF

echo $(date) " - Script Complete"


echo $(date) " - Starting Infra / Node Prep Script"

export USERNAME_ORG=${USERNAME_ORG}
export PASSWORD_ACT_KEY=${PASSWORD_ACT_KEY}
export POOL_ID=${POOL_ID}
export REPOSERVER=${REPOSERVER}
export REGISTRYSERVER=${REGISTRYSERVER}
export PRIVATEIP=${PRIVATEIP}
export ROUTERIP=${ROUTERIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRADNS=${INFRADNS}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}

# Remove RHUI

rm -f /etc/yum.repos.d/*.repo
sleep 10

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    # connected
    # Register Host with Cloud Access Subscription
    echo $(date) " - Register host with Cloud Access Subscription"

    subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
    RETCODE=$?

    if [ $RETCODE -eq 0 ]
    then
        echo "Subscribed successfully"
    elif [ $RETCODE -eq 64 ]
    then
        echo "This system is already registered."
    else
        sleep 5
        subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
        RETCODE2=$?
        if [ $RETCODE2 -eq 0 ]
        then
            echo "Subscribed successfully"
        elif [ $RETCODE2 -eq 64 ]
        then
            echo "This system is already registered."
        else
            echo "Incorrect Username / Password or Organization ID / Activation Key specified. Unregistering system from RHSM"
            subscription-manager unregister
            exit 3
        fi
    fi

    subscription-manager attach --pool=${POOL_ID} > attach.log
    if [ $? -eq 0 ]
    then
        echo "Pool attached successfully"
    else
        grep attached attach.log
        if [ $? -eq 0 ]
        then
            echo "Pool ${POOL_ID} was already attached and was not attached again."
        else
            echo "Incorrect Pool ID or no entitlements available"
            exit 4
        fi
    fi

    # Disable all repositories and enable only the required ones
    echo $(date) " - Disabling all repositories and enabling only the required repos"

    subscription-manager repos --disable="*"

    subscription-manager repos \
        --enable="rhel-7-server-rpms" \
        --enable="rhel-7-server-extras-rpms" \
        --enable="rhel-7-server-ose-3.11-rpms" \
        --enable="rhel-7-server-ansible-2.6-rpms" \
        --enable="rhel-7-fast-datapath-rpms" \
        --enable="rh-gluster-3-client-for-rhel-7-server-rpms" \
        --enable="rhel-7-server-optional-rpms"
else

cat > /etc/yum.repos.d/ose.repo <<EOF
[rhel-7-repo]
name=rhel-7-repo
baseurl=http://${REPOSERVER}/repos
enabled=1
gpgcheck=0
EOF

fi

# Install base packages and update system to latest packages
echo $(date) " - Install base packages and update system to latest packages"

yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion kexec-tools sos psacct ansible
yum -y install cloud-utils-growpart.noarch
yum -y update glusterfs-fuse
yum -y update --exclude=WALinuxAgent
echo $(date) " - Base package insallation and updates complete"

# Grow Root File System
echo $(date) " - Grow Root FS"

rootdev=`findmnt --target / -o SOURCE -n`
rootdrivename=`lsblk -no pkname $rootdev`
rootdrive="/dev/"$rootdrivename
name=`lsblk  $rootdev -o NAME | tail -1`
part_number=${name#*${rootdrivename}}

growpart $rootdrive $part_number -u on
xfs_growfs $rootdev

if [ $? -eq 0 ]
then
    echo "Root partition expanded"
else
    echo "Root partition failed to expand"
    exit 6
fi

# Install Docker
echo $(date) " - Installing Docker"
yum -y install docker

# Update docker config for insecure registry
rm -f /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
  "insecure-registries" : ["${REGISTRYSERVER}","docker-registry-default.${INFRADNS}"]
}
EOF

# Create thin pool logical volume for Docker
echo $(date) " - Creating thin pool logical volume for Docker and staring service"

DOCKERVG=$( parted -m /dev/sda print all 2>/dev/null | grep unknown | grep /dev/sd | cut -d':' -f1 | head -n1 )

echo "
# Adding OpenShift data disk for docker
DEVS=${DOCKERVG}
VG=docker-vg
" >> /etc/sysconfig/docker-storage-setup

# Running setup for docker storage
docker-storage-setup
if [ $? -eq 0 ]
then
    echo "Docker thin pool logical volume created successfully"
else
    echo "Error creating logical volume for Docker"
    exit 5
fi

# Enable and start Docker services
sysctl -w vm.max_map_count=262144

systemctl enable docker
systemctl start docker

# Add DNS host entries for cluster naming
cat >> /etc/hosts <<EOF
${PRIVATEIP} ${PRIVATEDNS}
${ROUTERIP} ${INFRADNS}
EOF

echo $(date) " - Script Complete"


echo $(date) " - Starting Bastion Prep Script"

export USERNAME_ORG=${USERNAME_ORG}
export PASSWORD_ACT_KEY="${PASSWORD_ACT_KEY}"
export POOL_ID=${POOL_ID}
# export PRIVATEKEY=$4
export SUDOUSER=${SUDOUSER}
export CUSTOMROUTINGCERTTYPE=${CUSTOMROUTINGCERTTYPE}
export CUSTOMMASTERCERTTYPE=${CUSTOMMASTERCERTTYPE}
export CUSTOMROUTINGCAFILE="${CUSTOMROUTINGCAFILE}"
export CUSTOMROUTINGCERTFILE="${CUSTOMROUTINGCERTFILE}"
export CUSTOMROUTINGKEYFILE="${CUSTOMROUTINGKEYFILE}"
export CUSTOMMASTERCAFILE="${CUSTOMMASTERCAFILE}"
export CUSTOMMASTERCERTFILE="${CUSTOMMASTERCERTFILE}"
export CUSTOMMASTERKEYFILE="${CUSTOMMASTERKEYFILE}"
export CUSTOMDOMAIN="${CUSTOMDOMAIN}"
export MINORVERSION=${MINORVERSION}
export CUSTOMMASTERTYPE=${CUSTOMMASTERTYPE}
export CUSTOMROUTINGTYPE=${CUSTOMROUTINGTYPE}
export REPOSERVER=${REPOSERVER}
export PRIVATEIP=${PRIVATEIP}
export ROUTERIP=${ROUTERIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRADNS=${INFRADNS}
# export SCRIPTSLOCATION=${23}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}
export REGISTRYSERVER=${REGISTRYSERVER}

# # Generate private keys for use by Ansible
# **********Moved to deployment scripts
# echo $(date) " - Generating Private keys for use by Ansible for OpenShift Installation"

# runuser -l $SUDOUSER -c "echo \"$PRIVATEKEY\" > ~/.ssh/id_rsa"
# runuser -l $SUDOUSER -c "chmod 600 ~/.ssh/id_rsa*"

# Remove RHUI

rm -f /etc/yum.repos.d/*.repo
sleep 10

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    # connected
    # Register Host with Cloud Access Subscription
    echo $(date) " - Register host with Cloud Access Subscription"

    subscription-manager register --force --username="${USERNAME_ORG}" --password="${PASSWORD_ACT_KEY}" || subscription-manager register --force --activationkey="${PASSWORD_ACT_KEY}" --org="${USERNAME_ORG}"
    RETCODE=$?

    if [ $RETCODE -eq 0 ]
    then
        echo "Subscribed successfully"
    elif [ $RETCODE -eq 64 ]
    then
        echo "This system is already registered."
    else
        echo "Incorrect Username / Password or Organization ID / Activation Key specified"
        exit 3
    fi

    subscription-manager attach --pool=${POOL_ID} > attach.log
    if [ $? -eq 0 ]
    then
        echo "Pool attached successfully"
    else
        grep attached attach.log
        if [ $? -eq 0 ]
        then
            echo "Pool ${POOL_ID} was already attached and was not attached again."
        else
            echo "Incorrect Pool ID or no entitlements available"
            exit 4
        fi
    fi

    # Disable all repositories and enable only the required ones
    echo $(date) " - Disabling all repositories and enabling only the required repos"

    subscription-manager repos --disable="*"

    subscription-manager repos \
        --enable="rhel-7-server-rpms" \
        --enable="rhel-7-server-extras-rpms" \
        --enable="rhel-7-server-ose-3.11-rpms" \
        --enable="rhel-7-server-ansible-2.6-rpms" \
        --enable="rhel-7-fast-datapath-rpms" \
        --enable="rh-gluster-3-client-for-rhel-7-server-rpms" \
        --enable="rhel-7-server-optional-rpms"
else
    # wget http://10.3.101.17/ocp-3-11-single-subnet/scripts/ose.repo
    # mv -f ose.repo /etc/yum.repos.d/ose.repo

    # disconnected
cat > /etc/yum.repos.d/ose.repo <<EOF
[rhel-7-repo]
name=rhel-7-repo
baseurl=http://${REPOSERVER}/repos
enabled=1
gpgcheck=0
EOF

fi

# Update system to latest packages
echo $(date) " - Update system to latest packages"
yum -y update --exclude=WALinuxAgent
echo $(date) " - System update complete"

# Install base packages and update system to latest packages
echo $(date) " - Install base packages"
yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion httpd-tools kexec-tools sos psacct ansible
yum -y update glusterfs-fuse
echo $(date) " - Base package installation complete"

# Install OpenShift utilities
echo $(date) " - Installing OpenShift utilities"
yum -y install openshift-ansible-3.11.${MINORVERSION}
echo $(date) " - OpenShift utilities installation complete"

# Install Docker
echo $(date) " - Installing Docker"
yum -y install docker

# Update docker config for insecure registry
rm -f /etc/docker/daemon.json
cat > /etc/docker/daemon.json <<EOF
{
  "insecure-registries" : ["${REGISTRYSERVER}","docker-registry-default.${INFRADNS}"]
}
EOF

systemctl enable docker
systemctl start docker

# Installing Azure CLI
# From https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-yum
echo $(date) " - Installing Azure CLI"
# sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
# sudo sh -c 'echo -e "[azure-cli]\nname=Azure CLI\nbaseurl=https://packages.microsoft.com/yumrepos/azure-cli\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'
sudo yum install -y azure-cli
echo $(date) " - Azure CLI installation complete"

# Install ImageMagick to resize image for Custom Header
sudo yum install -y ImageMagick

# Configure DNS so it always has the domain name
echo $(date) " - Adding DOMAIN to search for resolv.conf"
if [[ "${CUSTOMDOMAIN}" == "none" ]]
then
	DOMAINNAME=`domainname -d`
else
	DOMAINNAME=${CUSTOMDOMAIN}
fi

echo "DOMAIN=${DOMAINNAME}" >> /etc/sysconfig/network-scripts/ifcfg-eth0

echo $(date) " - Restarting NetworkManager"
runuser -l ${SUDOUSER} -c "ansible localhost -o -b -m service -a \"name=NetworkManager state=restarted\""
echo $(date) " - NetworkManager configuration complete"

# Run Ansible Playbook to update ansible.cfg file
echo $(date) " - Updating ansible.cfg file"
if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 -t 5 https://raw.githubusercontent.com/microsoft/openshift-container-platform-playbooks/master/updateansiblecfg.yaml
    ansible-playbook -f 10 ./updateansiblecfg.yaml
else
    wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 -t 5 http://${SCRIPTSLOCATION}/ocpp/updateansiblecfg.yaml
    ansible-playbook -f 10 ./ocpp/updateansiblecfg.yaml
fi

# Create certificate files

if [[ "${CUSTOMMASTERCERTTYPE}" == "custom" ]]
then
    echo $(date) " - Creating custom master certificate files"
    runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERCAFILE}\" > /tmp/masterca.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERCERTFILE}\" > /tmp/mastercert.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMMASTERKEYFILE}\" > /tmp/masterkey.pem"
	echo $(date) " - Custom master certificate files masterca.pem, mastercert.pem, masterkey.pem created in /tmp"
fi

if [ "${CUSTOMROUTINGCERTTYPE}" == "custom" ]
then
    echo $(date) " - Creating custom routing certificate files"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGCAFILE}\" > /tmp/routingca.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGCERTFILE}\" > /tmp/routingcert.pem"
	runuser -l ${SUDOUSER} -c "echo \"${CUSTOMROUTINGKEYFILE}\" > /tmp/routingkey.pem"
	echo $(date) " - Custom routing certificate files routingca.pem, routingcert.pem, routingkey.pem created in /tmp"
fi

# Add DNS host entries for cluster naming
cat >> /etc/hosts <<EOF
${PRIVATEIP} ${PRIVATEDNS}
${ROUTERIP} ${INFRADNS}
EOF

echo $(date) " - Script Complete"


echo $(date) " - Starting Script"

set -e

export SUDOUSER=${SUDOUSER}
export PASSWORD=${PASSWORD}
export MASTER=${MASTER}
export MASTERPUBLICIPHOSTNAME=${MASTERPUBLICIPHOSTNAME}
export MASTERPUBLICIPADDRESS=${MASTERPUBLICIPADDRESS}
export INFRA=${INFRA}
export NODE=${NODE}
export NODECOUNT=${NODECOUNT}
export INFRACOUNT=${INFRACOUNT}
export MASTERCOUNT=${MASTERCOUNT}
export ROUTING=${ROUTING}
export REGISTRYSA=${REGISTRYSA}
export ACCOUNTKEY=${ACCOUNTKEY}
export METRICS=${METRICS}
export LOGGING=${LOGGING}
export TENANTID=${TENANTID}
export SUBSCRIPTIONID=${SUBSCRIPTIONID}
export AADCLIENTID=${AADCLIENTID}
export AADCLIENTSECRET=${AADCLIENTSECRET}
export RESOURCEGROUP=${RESOURCEGROUP}
export LOCATION=${LOCATION}
export AZURE=${AZURE}
export STORAGEKIND=${STORAGEKIND}
export ENABLECNS=${ENABLECNS}
export CNS=${CNS}
export CNSCOUNT=${CNSCOUNT}
export VNETNAME=${VNETNAME}
export NODENSG=${NODENSG}
export NODEAVAILIBILITYSET=${NODEAVAILIBILITYSET}
export MASTERCLUSTERTYPE=${MASTERCLUSTERTYPE}
export PRIVATEIP=${PRIVATEIP}
export PRIVATEDNS=${PRIVATEDNS}
export INFRAPIPNAME=${INFRAPIPNAME}
export CUSTOMROUTINGCERTTYPE=${CUSTOMROUTINGCERTTYPE}
export CUSTOMMASTERCERTTYPE=${CUSTOMMASTERCERTTYPE}
export MINORVERSION=${MINORVERSION}
export REPOSERVER=${REPOSERVER}
export REGISTRYSERVER=${REGISTRYSERVER}
export DEPLOYMENTTYPE=${DEPLOYMENTTYPE}
export DOCKERREGISTRYREALM=${DOCKERREGISTRYREALM} #
# export CLOUDNAME=${CLOUDNAME} # for AAD
export BASTION=$(hostname)

# Set CNS to default storage type.  Will be overridden later if Azure is true
export CNS_DEFAULT_STORAGE=true

# Setting DOMAIN variable
export DOMAIN=`domainname -d`

# Determine if Commercial Azure or Azure Government
# CLOUD=$( curl -H Metadata:true "http://169.254.169.254/metadata/instance/compute/location?api-version=2017-04-02&format=text" | cut -c 1-2 )
export CLOUD=${CLOUD^^}
# export CLOUDNAME="AzureUSGovernmentCloud"
# export CLOUDNAME="AzurePublicCloud"

export MASTERLOOP=$((MASTERCOUNT - 1))
export INFRALOOP=$((INFRACOUNT - 1))
export NODELOOP=$((NODECOUNT - 1))

echo $(date) " - Configuring SSH ControlPath to use shorter path name"

sed -i -e "s/^# control_path = %(directory)s\/%%h-%%r/control_path = %(directory)s\/%%h-%%r/" /etc/ansible/ansible.cfg
sed -i -e "s/^#host_key_checking = False/host_key_checking = False/" /etc/ansible/ansible.cfg
sed -i -e "s/^#pty=False/pty=False/" /etc/ansible/ansible.cfg
sed -i -e "s/^#stdout_callback = skippy/stdout_callback = skippy/" /etc/ansible/ansible.cfg
sed -i -e "s/^#pipelining = False/pipelining = True/" /etc/ansible/ansible.cfg

# echo $(date) " - Modifying sudoers"
sed -i -e "s/Defaults    requiretty/# Defaults    requiretty/" /etc/sudoers
sed -i -e '/Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"/aDefaults    env_keep += "PATH"' /etc/sudoers

# Setting the default openshift_cloudprovider_kind if Azure enabled
if [[ ${AZURE} == "true" ]]
then
    CLOUDKIND="openshift_cloudprovider_kind=azure
openshift_cloudprovider_azure_client_id=${AADCLIENTID}
openshift_cloudprovider_azure_client_secret=${AADCLIENTSECRET}
openshift_cloudprovider_azure_tenant_id=${TENANTID}
openshift_cloudprovider_azure_subscription_id=${SUBSCRIPTIONID}
openshift_cloudprovider_azure_cloud=${CLOUDNAME}
openshift_cloudprovider_azure_vnet_name=${VNETNAME}
openshift_cloudprovider_azure_security_group_name=${NODENSG}
openshift_cloudprovider_azure_availability_set_name=${NODEAVAILIBILITYSET}
openshift_cloudprovider_azure_resource_group=${RESOURCEGROUP}
openshift_cloudprovider_azure_location=${LOCATION}"
	CNS_DEFAULT_STORAGE=false
	if [[ ${STORAGEKIND} == "managed" ]]
	then
		SCKIND="openshift_storageclass_parameters={'kind': 'managed', 'storageaccounttype': 'Premium_LRS'}"
	else
		SCKIND="openshift_storageclass_parameters={'kind': 'shared', 'storageaccounttype': 'Premium_LRS'}"
	fi
fi

# Cloning Ansible playbook repository

echo $(date) " - Cloning Ansible playbook repository"

if [[ ${DEPLOYMENTTYPE} == 3 ]]
then
    #Connected use this:
    ((cd /home/${SUDOUSER} && git clone https://github.com/Microsoft/openshift-container-platform-playbooks.git) || (cd /home/${SUDOUSER}/openshift-container-platform-playbooks && git pull))
else
    #Disconnected use this:
    cd /home/${SUDOUSER} && wget -r -np ${REPOSERVER}/ocpp/
    [ -d /home/${SUDOUSER}/openshift-container-platform-playbooks ] && rm -rf /home/${SUDOUSER}/openshift-container-platform-playbooks
    mv /home/${SUDOUSER}/${REPOSERVER}/ocpp /home/${SUDOUSER}/openshift-container-platform-playbooks
    [ -d /home/${SUDOUSER}/${REPOSERVER} ] && rm -rf /home/${SUDOUSER}/${REPOSERVER}
    cd /home/${SUDOUSER}/openshift-container-platform-playbooks
fi

if [ -d /home/${SUDOUSER}/openshift-container-platform-playbooks ]
then
    echo " - Retrieved playbooks successfully"
else
    echo " - Retrieval of playbooks failed"
    exit 7
fi

# Configure custom routing certificate
echo $(date) " - Create variable for routing certificate based on certificate type"
if [[ ${CUSTOMROUTINGCERTTYPE} == "custom" ]]
then
	ROUTINGCERTIFICATE="openshift_hosted_router_certificate={\"cafile\": \"/tmp/routingca.pem\", \"certfile\": \"/tmp/routingcert.pem\", \"keyfile\": \"/tmp/routingkey.pem\"}"
else
	ROUTINGCERTIFICATE=""
fi

# Configure master cluster address information based on Cluster type (private or public)
echo $(date) " - Create variable for master cluster address based on cluster type"
if [[ ${MASTERCLUSTERTYPE} == "private" ]]
then
    MASTERCLUSTERHOSTNAME=${PRIVATEDNS}
	MASTERCLUSTERADDRESS="openshift_master_cluster_hostname=${MASTER}-001v
openshift_master_cluster_public_hostname=${PRIVATEDNS}
openshift_master_cluster_public_vip=${PRIVATEIP}"
else
    MASTERCLUSTERHOSTNAME=${MASTERPUBLICIPHOSTNAME}
	MASTERCLUSTERADDRESS="openshift_master_cluster_hostname=${MASTERPUBLICIPHOSTNAME}
openshift_master_cluster_public_hostname=${MASTERPUBLICIPHOSTNAME}
openshift_master_cluster_public_vip=${MASTERPUBLICIPADDRESS}"
fi

# Configure custom master API certificate
echo $(date) " - Create variable for master api certificate based on certificate type"
if [[ ${CUSTOMMASTERCERTTYPE} == "custom" ]]
then
	MASTERCERTIFICATE="openshift_master_overwrite_named_certificates=true
openshift_master_named_certificates=[{\"names\": [\"${MASTERCLUSTERHOSTNAME}\"], \"cafile\": \"/tmp/masterca.pem\", \"certfile\": \"/tmp/mastercert.pem\", \"keyfile\": \"/tmp/masterkey.pem\"}]"
else
	MASTERCERTIFICATE=""
fi

# Create Master nodes grouping
echo $(date) " - Creating Master nodes grouping"
MASTERLIST="00${MASTERCOUNT}"
for c in $(seq -f "%03g" 1 ${MASTERCOUNT})
do
    mastergroup="$mastergroup
${MASTER}-${c}v openshift_node_group_name='node-config-master'"
done

# Create Infra nodes grouping
echo $(date) " - Creating Infra nodes grouping"
for c in $(seq -f "%03g" 1 ${INFRACOUNT})
do
    infragroup="$infragroup
${INFRA}-${c}v openshift_node_group_name='node-config-infra'"
done

# Create Nodes grouping
echo $(date) " - Creating Nodes grouping"
for c in $(seq -f "%03g" 1 ${NODECOUNT})
do
    nodegroup="$nodegroup
${NODE}-${c}v openshift_node_group_name='node-config-compute'"
done

# Create CNS nodes grouping if CNS is enabled
if [[ ${ENABLECNS} == "true" ]]
then
    echo $(date) " - Creating CNS nodes grouping"

    for c in $(seq -f "%03g" 1 ${CNSCOUNT})
    do
        cnsgroup="$cnsgroup
${CNS}-${c}v openshift_node_group_name='node-config-compute'"
    done
fi

# Setting the HA Mode if more than one master
if [ ${MASTERCOUNT} != 1 ]
then
	echo $(date) " - Enabling HA mode for masters"
    export HAMODE="openshift_master_cluster_method=native"
fi

# Create Temp Ansible Hosts File
echo $(date) " - Create Ansible Hosts file"

cat > /etc/ansible/hosts <<EOF
[tempnodes]
$mastergroup
$infragroup
$nodegroup
$cnsgroup
EOF

# Run a loop playbook to ensure DNS Hostname resolution is working prior to continuing with script
echo $(date) " - Running DNS Hostname resolution check"
runuser -l ${SUDOUSER} -c "ansible-playbook ~/openshift-container-platform-playbooks/check-dns-host-name-resolution.yaml"

# Create glusterfs configuration if CNS is enabled
if [[ ${ENABLECNS} == "true" ]]
then
    echo $(date) " - Creating glusterfs configuration"

	# Ensuring selinux is configured properly
    echo $(date) " - Setting selinux to allow gluster-fuse access"
    runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -a 'sudo setsebool -P virt_sandbox_use_fusefs on'" || true
	runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -a 'sudo setsebool -P virt_use_fusefs on'" || true

    for c in $(seq -f "%03g" 1 ${CNSCOUNT})
    do
        runuser ${SUDOUSER} -c "ssh-keyscan -H ${CNS}-${c}v >> ~/.ssh/known_hosts"
        drive=$(runuser ${SUDOUSER} -c "ssh ${CNS}-${c}v 'sudo /usr/sbin/fdisk -l'" | awk '$1 == "Disk" && $2 ~ /^\// && ! /mapper/ {if (drive) print drive; drive = $2; sub(":", "", drive);} drive && /^\// {drive = ""} END {if (drive) print drive;}')
        drive1=$(echo $drive | cut -d ' ' -f 1)
        drive2=$(echo $drive | cut -d ' ' -f 2)
        drive3=$(echo $drive | cut -d ' ' -f 3)
        cnsglusterinfo="$cnsglusterinfo
${CNS}-${c}v glusterfs_devices='[ \"${drive1}\", \"${drive2}\", \"${drive3}\" ]'"
    done

    HOSTEDREGISTRYVALS="openshift_hosted_registry_storage_kind=glusterfs
openshift_hosted_registry_storage_volume_size=20Gi
openshift_hosted_registry_selector='node-role.kubernetes.io/infra=true'"

else

    HOSTEDREGISTRYVALS="openshift_hosted_registry_storage_kind=object
openshift_hosted_registry_storage_provider=azure_blob
openshift_hosted_registry_storage_azure_blob_accountname=${REGISTRYSA}
openshift_hosted_registry_storage_azure_blob_accountkey=${ACCOUNTKEY}
openshift_hosted_registry_storage_azure_blob_container=registry
openshift_hosted_registry_storage_azure_blob_realm=$DOCKERREGISTRYREALM"

fi

# Create Ansible Hosts File
echo $(date) " - Create Ansible Hosts file"

cat > /etc/ansible/hosts <<EOF
# Create an OSEv3 group that contains the masters and nodes groups
[OSEv3:children]
masters
nodes
etcd
master0
glusterfs
glusterfs_registry
new_nodes

# Set variables common for all OSEv3 hosts
[OSEv3:vars]
ansible_ssh_user=${SUDOUSER}
ansible_become=yes
openshift_install_examples=true
deployment_type=openshift-enterprise
openshift_release=v3.11
openshift_image_tag=v3.11.${MINORVERSION}
openshift_pkg_version=-3.11.${MINORVERSION}
docker_udev_workaround=True
openshift_use_dnsmasq=true
openshift_master_default_subdomain=${ROUTING}
openshift_override_hostname_check=true
osm_use_cockpit=true
os_sdn_network_plugin_name='redhat/openshift-ovs-multitenant'
openshift_master_api_port=443
openshift_master_console_port=443
osm_default_node_selector='node-role.kubernetes.io/compute=true'
openshift_disable_check=memory_availability,docker_image_availability
$CLOUDKIND
$SCKIND
$CUSTOMCSS
$ROUTINGCERTIFICATE
$MASTERCERTIFICATE
$PROXY

# Workaround for docker image failure
# https://access.redhat.com/solutions/3480921
oreg_url=${REGISTRYSERVER}/openshift3/ose-\${component}:\${version}
openshift_examples_modify_imagestreams=true

# default selectors for router and registry services
openshift_router_selector='node-role.kubernetes.io/infra=true'
openshift_registry_selector='node-role.kubernetes.io/infra=true'

# Configure registry not to use Azure blob storage
openshift_hosted_registry_replicas=1
$HOSTEDREGISTRYVALS

# Deploy Service Catalog
openshift_enable_service_catalog=false

# Type of clustering being used by OCP
$HAMODE

# Addresses for connecting to the OpenShift master nodes
$MASTERCLUSTERADDRESS

# Enable HTPasswdPasswordIdentityProvider
openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true', 'challenge': 'true', 'kind': 'HTPasswdPasswordIdentityProvider'}]

# Specify CNS images
openshift_storage_glusterfs_image=${REGISTRYSERVER}/rhgs3/rhgs-server-rhel7:v3.11
openshift_storage_glusterfs_block_image=${REGISTRYSERVER}/rhgs3/rhgs-gluster-block-prov-rhel7:v3.11
openshift_storage_glusterfs_s3_image=${REGISTRYSERVER}/rhgs3/rhgs-s3-server-rhel7:v3.11
openshift_storage_glusterfs_heketi_image=${REGISTRYSERVER}/rhgs3/rhgs-volmanager-rhel7:v3.11

# Setup metrics
openshift_metrics_install_metrics=$METRICS
openshift_metrics_start_cluster=$METRICS
openshift_metrics_hawkular_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_metrics_cassandra_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_metrics_heapster_nodeselector={"node-role.kubernetes.io/infra":"true"}

# Setup logging
openshift_logging_install_logging=$LOGGING
openshift_logging_fluentd_nodeselector={"logging":"true"}
openshift_logging_es_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_kibana_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_curator_nodeselector={"node-role.kubernetes.io/infra":"true"}
openshift_logging_master_public_url=https://${MASTERCLUSTERHOSTNAME}

# host group for masters
[masters]
${MASTER}-[001:${MASTERLIST}]v

# host group for etcd
[etcd]
${MASTER}-[001:${MASTERLIST}]v

[master0]
${MASTER}-001v

# Only populated when CNS is enabled
[glusterfs]
$cnsglusterinfo

[glusterfs_registry]
$cnsglusterinfo

# host group for nodes
[nodes]
$mastergroup
$infragroup
$nodegroup
$cnsgroup

# host group for adding new nodes
[new_nodes]
EOF

# Update WALinuxAgent
echo $(date) " - Updating WALinuxAgent on all cluster nodes"
runuser ${SUDOUSER} -c "ansible all -f 30 -b -m yum -a 'name=WALinuxAgent state=latest'"

# Setup NetworkManager to manage eth0
echo $(date) " - Running NetworkManager playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-node/network_manager.yml"

# Configure DNS so it always has the domain name
echo $(date) " - Adding $DOMAIN to search for resolv.conf"
runuser ${SUDOUSER} -c "ansible all -o -f 30 -b -m lineinfile -a 'dest=/etc/sysconfig/network-scripts/ifcfg-eth0 line=\"DOMAIN=$DOMAIN\"'"

# Configure resolv.conf on all hosts through NetworkManager
echo $(date) " - Restarting NetworkManager"
runuser -l ${SUDOUSER} -c "ansible all -o -f 30 -b -m service -a \"name=NetworkManager state=restarted\""
echo $(date) " - NetworkManager configuration complete"

# Restarting things so everything is clean before continuing with installation
echo $(date) " - Rebooting cluster to complete installation"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/reboot-master.yaml"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/reboot-nodes.yaml"
sleep 20

# Run OpenShift Container Platform prerequisites playbook
echo $(date) " - Running Prerequisites via Ansible Playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/prerequisites.yml"
echo $(date) " - Prerequisites check complete"

# Initiating installation of OpenShift Container Platform using Ansible Playbook
echo $(date) " - Installing OpenShift Container Platform via Ansible Playbook"
runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 /usr/share/ansible/openshift-ansible/playbooks/deploy_cluster.yml"
if [ $? -eq 0 ]
then
    echo $(date) " - OpenShift Cluster installed successfully"
else
    echo $(date) " - OpenShift Cluster failed to install"
    exit 6
fi

# Install OpenShift Atomic Client
cd /root
mkdir .kube
runuser ${SUDOUSER} -c "scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${SUDOUSER}@${MASTER}-001v:~/.kube/config /tmp/kube-config"
cp /tmp/kube-config /root/.kube/config
mkdir /home/${SUDOUSER}/.kube
cp /tmp/kube-config /home/${SUDOUSER}/.kube/config
chown --recursive ${SUDOUSER} /home/${SUDOUSER}/.kube
rm -f /tmp/kube-config
yum -y install atomic-openshift-clients

# Adding user to OpenShift authentication file
echo $(date) " - Adding OpenShift user"
runuser ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/addocpuser.yaml"

# Assigning cluster admin rights to OpenShift user
echo $(date) " - Assigning cluster admin rights to user"
runuser ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/assignclusteradminrights.yaml"

# Installing Service Catalog, Ansible Service Broker and Template Service Broker
if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
then
    runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_enable_service_catalog=true -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-service-catalog/config.yml"
fi

# Adding Open Sevice Broker for Azaure (requires service catalog)
# Disabling deployment of OSBA
if [[ ${AZURE} == "true" ]]
then
    oc new-project osba
    oc process -f https://raw.githubusercontent.com/Azure/open-service-broker-azure/master/contrib/openshift/osba-os-template.yaml  \
        -p ENVIRONMENT=AzurePublicCloud \
        -p AZURE_SUBSCRIPTION_ID=${SUBSCRIPTIONID} \
        -p AZURE_TENANT_ID=${TENANTID} \
        -p AZURE_CLIENT_ID=${AADCLIENTID} \
        -p AZURE_CLIENT_SECRET=${AADCLIENTSECRET} \
        | oc create -f -
fi

# Configure Metrics
if [[ ${METRICS} == "true" ]]
then
    sleep 30
    echo $(date) "- Deploying Metrics"
    if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
    then
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_metrics_install_metrics=True -e openshift_metrics_cassandra_storage_type=dynamic -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-metrics/config.yml"
    else
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_metrics_install_metrics=True /usr/share/ansible/openshift-ansible/playbooks/openshift-metrics/config.yml"
    fi
    if [ $? -eq 0 ]
    then
        echo $(date) " - Metrics configuration completed successfully"
    else
        echo $(date) " - Metrics configuration failed"
        exit 11
    fi
fi

# Configure Logging

if [[ ${LOGGING} == "true" ]]
then
    sleep 60
    echo $(date) "- Deploying Logging"
    if [[ ${AZURE} == "true" || ${ENABLECNS} == "true" ]]
    then
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_logging_install_logging=True -e openshift_logging_es_pvc_dynamic=true -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-logging/config.yml"
    else
        runuser -l ${SUDOUSER} -c "ansible-playbook -e openshift_logging_install_logging=True -f 30 /usr/share/ansible/openshift-ansible/playbooks/openshift-logging/config.yml"
    fi
    if [ $? -eq 0 ]
    then
        echo $(date) " - Logging configuration completed successfully"
    else
        echo $(date) " - Logging configuration failed"
        exit 12
    fi
fi

if [[ ${AZURE} == "true" ]]
then
    # Creating variables file for private master and Azure AD configuration playbook
    echo $(date) " - Creating variables file for future playbooks"
cat > /home/${SUDOUSER}/openshift-container-platform-playbooks/vars.yaml <<EOF
admin_user: $SUDOUSER
master_lb_private_dns: $PRIVATEDNS
domain: $DOMAIN
EOF

    # Configure cluster for private masters
    if [[ ${MASTERCLUSTERTYPE} == "private" ]]
    then
        echo $(date) " - Configure cluster for private masters"
        runuser -l ${SUDOUSER} -c "ansible-playbook -f 30 ~/openshift-container-platform-playbooks/activate-private-lb-fqdn.31x.yaml"
    fi
fi

# Delete yaml files
echo $(date) " - Deleting unecessary files"
rm -rf /home/${SUDOUSER}/openshift-container-platform-playbooks

# Delete pem files
echo $(date) " - Delete pem files"
rm -rf /tmp/*.pem

echo $(date) " - Sleep for 15 seconds"
sleep 15

echo $(date) " - Script complete"

# *.apps.beta-openshift.com == 10.3.101.200
# *.console.beta-openshift.com == 10.3.101.100

# address=/console.dev-openshift.com/10.3.104.100
# address=/apps.dev-openshift.com/10.3.104.200