/*
 * Copyright © 2020 Atomist, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

import * as gcp from "@pulumi/gcp";
import * as pulumi from "@pulumi/pulumi";

import { simpleRoleName } from "./iam";

/** GKE workload identity configuration. */
export interface WorkloadIdentityConfiguration {
	/**
	 * Options to use when creating the resources. This should have at
	 * least `{ dependsOn: [cluster] }`, as the workload identity IAM
	 * policy cannot be created until the cluster with that identity
	 * exists.
	 */
	options: pulumi.CustomResourceOptions;
	/** GCP project ID to create resources */
	projectId: string;
	/** GCP IAM roles to bind to service account */
	projectRoles: string[];
	/** Kubernetes service account name */
	workload: string;
	/** Kubernetes service account namespace */
	workloadNamespace: string;
	/** Set to true to import, rather than create, the resources. */
	import?: boolean;
	/**
	 * GCP project ID of workload. If not provided, [[projectId]] is
	 * used.
	 */
	workloadProject?: string;
}

/**
 * Create a GCP service account for workload identity, bind the
 * provided roles to the GCP service account, and then link the GCP
 * service account to the Kubernetes workload, i.e., service account.
 */
export function workloadIdentity(
	wi: WorkloadIdentityConfiguration,
): gcp.serviceaccount.Account {
	const workloadProject = wi.workloadProject || wi.projectId;
	const wiServiceAccountName = `gke-wi-sa-${wi.workload}`.substring(0, 30);
	const wiServiceAccountEmail = `${wiServiceAccountName}@${wi.projectId}.iam.gserviceaccount.com`;
	const wiServiceAccount = new gcp.serviceaccount.Account(
		wiServiceAccountName,
		{
			accountId: wiServiceAccountName,
			description: `GKE Workload Identity Service Account for ${wi.workloadNamespace}/${wi.workload}`,
			displayName: `${wi.workload} Workload Identity Service Account`,
			project: workloadProject,
		},
		{
			import: wi.import
				? `projects/${wi.projectId}/serviceAccounts/${wiServiceAccountEmail}`
				: undefined,
			...wi.options,
		},
	);
	for (const role of wi.projectRoles) {
		new gcp.projects.IAMMember(
			`gke-wi-sa-${wi.workload}-${simpleRoleName(role)}-member`,
			{
				member: pulumi.concat(
					"serviceAccount:",
					wiServiceAccount.email,
				),
				project: wi.projectId,
				role,
			},
			{
				import: wi.import
					? `${wi.projectId} ${role} serviceAccount:${wiServiceAccountEmail}`
					: undefined,
				...wi.options,
			},
		);
	}
	new gcp.serviceaccount.IAMPolicy(
		`gke-wi-sa-${wi.workload}-policy`,
		{
			policyData: JSON.stringify({
				bindings: [
					{
						members: [
							`serviceAccount:${workloadProject}.svc.id.goog[${wi.workloadNamespace}/${wi.workload}]`,
						],
						role: "roles/iam.workloadIdentityUser",
					},
				],
			}),
			serviceAccountId: wiServiceAccount.id,
		},
		wi.options,
	);
	return wiServiceAccount;
}