bootstrap.sh

#!/usr/bin/env bash
# scripts/bootstrap.sh — Idempotent OrbStack K8s + ArgoCD bootstrap
# Usage: ./scripts/bootstrap.sh [--skip-prereq] [--dry-run] [--verbose]
set -euo pipefail

# ----- Parse arguments -----
SKIP_PREREQ=false
DRY_RUN=false
VERBOSE=false

for arg in "$@"; do
  case "$arg" in
    --skip-prereq) SKIP_PREREQ=true ;;
    --dry-run)     DRY_RUN=true ;;
    --verbose)     VERBOSE=true ;;
    *)             echo "Unknown option: $arg"; exit 1 ;;
  esac
done

$VERBOSE && set -x

# ----- Config -----
ARGOCD_CHART_VERSION="9.0.1"
ARGOCD_NAMESPACE="argocd"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
START_TIME=$(date +%s)

# ----- Colors -----
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

info() { echo -e "${BLUE}[INFO]${NC} $1"; }
ok()   { echo -e "${GREEN}[OK]${NC}   $1"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
fail() { echo -e "${RED}[FAIL]${NC} $1"; }

# =====================================================================
# Phase 1/6: Prerequisites
# =====================================================================
phase1_prerequisites() {
  info "Phase 1/6: Checking prerequisites..."

  if $SKIP_PREREQ; then
    warn "Skipping prerequisites check (--skip-prereq)"
    return 0
  fi

  if [[ -x "$REPO_ROOT/scripts/prerequisites.sh" ]]; then
    bash "$REPO_ROOT/scripts/prerequisites.sh"
  else
    fail "scripts/prerequisites.sh not found or not executable"
    exit 1
  fi
}

# =====================================================================
# Phase 2/6: Cluster Readiness
# =====================================================================
phase2_cluster_check() {
  info "Phase 2/6: Verifying cluster readiness..."

  if [[ -x "$REPO_ROOT/validation/pre-deploy/check-cluster.sh" ]]; then
    bash "$REPO_ROOT/validation/pre-deploy/check-cluster.sh"
  else
    # Inline fallback
    kubectl config use-context orbstack &>/dev/null
    kubectl get --raw /healthz &>/dev/null || { fail "API server not healthy"; exit 2; }
    ok "Cluster is reachable (inline check)"
  fi
}

# =====================================================================
# Phase 3/6: ArgoCD Installation (Helm)
# =====================================================================
phase3_install_argocd() {
  info "Phase 3/6: Installing ArgoCD v3.1.9 (chart $ARGOCD_CHART_VERSION)..."

  if $DRY_RUN; then
    warn "Dry run — validating Helm template only"
    helm template argocd argo/argo-cd \
      --namespace "$ARGOCD_NAMESPACE" \
      --version "$ARGOCD_CHART_VERSION" \
      --values "$REPO_ROOT/argocd/helm-values/argocd/values.yaml" \
      > /dev/null
    ok "Helm template validates successfully"
    return 0
  fi

  # Add repo (idempotent)
  helm repo add argo https://argoproj.github.io/argo-helm 2>/dev/null || true
  helm repo update argo

  # Create namespace (idempotent)
  kubectl create namespace "$ARGOCD_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -

  # Install or upgrade ArgoCD
  helm upgrade --install argocd argo/argo-cd \
    --namespace "$ARGOCD_NAMESPACE" \
    --version "$ARGOCD_CHART_VERSION" \
    --values "$REPO_ROOT/argocd/helm-values/argocd/values.yaml" \
    --wait \
    --timeout 5m

  ok "ArgoCD installed/upgraded in namespace $ARGOCD_NAMESPACE"

  # Wait for critical deployments
  for deploy in argocd-server argocd-repo-server argocd-application-controller; do
    # Try deployment first, fall back to statefulset
    if kubectl -n "$ARGOCD_NAMESPACE" get deployment "$deploy" &>/dev/null; then
      kubectl -n "$ARGOCD_NAMESPACE" rollout status deployment/"$deploy" --timeout=120s
      ok "$deploy: Ready"
    elif kubectl -n "$ARGOCD_NAMESPACE" get statefulset "$deploy" &>/dev/null; then
      kubectl -n "$ARGOCD_NAMESPACE" rollout status statefulset/"$deploy" --timeout=120s
      ok "$deploy (StatefulSet): Ready"
    else
      warn "$deploy not found as Deployment or StatefulSet — checking pods..."
      # ArgoCD chart 9.x may use different names
      PODS=$(kubectl -n "$ARGOCD_NAMESPACE" get pods --selector "app.kubernetes.io/component=${deploy#argocd-}" --no-headers 2>/dev/null | head -1)
      if [[ -n "$PODS" ]]; then
        ok "$deploy: pod found"
      else
        fail "$deploy: not found"
        kubectl -n "$ARGOCD_NAMESPACE" get pods
        exit 3
      fi
    fi
  done
}

# =====================================================================
# Phase 4/6: ArgoCD AppProject
# =====================================================================
phase4_appproject() {
  info "Phase 4/6: Applying ArgoCD AppProject..."

  if $DRY_RUN; then
    warn "Dry run — skipping AppProject apply"
    return 0
  fi

  kubectl apply -f "$REPO_ROOT/argocd/projects/infrastructure.yaml"
  ok "AppProject 'infrastructure' created"
}

# =====================================================================
# Phase 5/6: ArgoCD Applications
# =====================================================================
phase5_applications() {
  info "Phase 5/6: Applying ArgoCD Applications..."

  if $DRY_RUN; then
    warn "Dry run — skipping Application apply"
    return 0
  fi

  # Apply all Application manifests directly (no Git dependency)
  # Exclude root-app-of-apps.yaml and namespace-templates.yaml (they require Git repo)
  for app_file in "$REPO_ROOT"/argocd/applications/*.yaml; do
    local filename
    filename=$(basename "$app_file")
    # Skip Git-dependent Applications
    if [[ "$filename" == "root-app-of-apps.yaml" || "$filename" == "namespace-templates.yaml" ]]; then
      warn "Skipping $filename (requires Git repo — apply after pushing to remote)"
      continue
    fi
    kubectl apply -f "$app_file"
    ok "Applied: $filename"
  done

  # Apply cluster-config (namespaces + ClusterIssuers)
  info "Applying cluster-config resources..."
  kubectl apply -k "$REPO_ROOT/kubernetes/cluster-config/namespaces/"
  ok "System namespaces created"

  # Wait for cert-manager to be ready before applying ClusterIssuers
  info "Waiting for cert-manager to be ready..."
  local timeout=180
  local elapsed=0
  local interval=10

  while [[ $elapsed -lt $timeout ]]; do
    SYNC=$(kubectl -n "$ARGOCD_NAMESPACE" get application cert-manager -o jsonpath='{.status.sync.status}' 2>/dev/null || echo "")
    HEALTH=$(kubectl -n "$ARGOCD_NAMESPACE" get application cert-manager -o jsonpath='{.status.health.status}' 2>/dev/null || echo "")

    if [[ "$SYNC" == "Synced" && "$HEALTH" == "Healthy" ]]; then
      ok "cert-manager: Synced, Healthy"
      break
    fi

    echo -ne "  Waiting for cert-manager... sync=$SYNC health=$HEALTH (${elapsed}s/${timeout}s)\r"
    sleep "$interval"
    ((elapsed += interval))
  done
  echo ""

  if [[ "$SYNC" == "Synced" && "$HEALTH" == "Healthy" ]]; then
    # Apply ClusterIssuer chain (requires cert-manager CRDs)
    kubectl apply -f "$REPO_ROOT/kubernetes/cluster-config/cert-manager/cluster-issuer-selfsigned.yaml"
    ok "ClusterIssuer chain applied (selfsigned-issuer → local-ca → local-ca-issuer)"
  else
    warn "cert-manager not ready yet — ClusterIssuers will need to be applied manually:"
    warn "  kubectl apply -f kubernetes/cluster-config/cert-manager/cluster-issuer-selfsigned.yaml"
  fi

  # Show application status
  echo ""
  info "ArgoCD Application status:"
  kubectl -n "$ARGOCD_NAMESPACE" get applications 2>/dev/null || true
}

# =====================================================================
# Phase 6/6: Post-Deploy Validation
# =====================================================================
phase6_validation() {
  info "Phase 6/6: Validating deployment..."

  if $DRY_RUN; then
    warn "Dry run — skipping validation"
    return 0
  fi

  if [[ -x "$REPO_ROOT/validation/post-deploy/check-argocd.sh" ]]; then
    bash "$REPO_ROOT/validation/post-deploy/check-argocd.sh" || true
  fi

  if [[ -x "$REPO_ROOT/validation/post-deploy/check-components.sh" ]]; then
    bash "$REPO_ROOT/validation/post-deploy/check-components.sh" || true
  fi

  if [[ -x "$REPO_ROOT/validation/post-deploy/check-ingress.sh" ]]; then
    bash "$REPO_ROOT/validation/post-deploy/check-ingress.sh" || true
  fi
}

# =====================================================================
# Completion Summary
# =====================================================================
print_summary() {
  local END_TIME
  END_TIME=$(date +%s)
  local ELAPSED=$((END_TIME - START_TIME))
  local MINS=$((ELAPSED / 60))
  local SECS=$((ELAPSED % 60))

  echo ""
  echo "============================================================"

  if $DRY_RUN; then
    echo "Dry run complete! No resources were modified."
  else
    echo "Bootstrap complete! Cluster is ready for application deployment."
    echo ""
    echo "ArgoCD UI:  https://argocd.k8s.orb.local"
    echo "  Username: admin"
    echo "  Password: kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d"
    echo ""
    echo "Grafana:    https://grafana.k8s.orb.local"
    echo "  Username: admin"
    echo "  Password: admin"
  fi

  printf "\nTime elapsed: %dm %ds\n" "$MINS" "$SECS"
  echo "============================================================"
  echo ""
}

# =====================================================================
# Main
# =====================================================================
main() {
  echo ""
  echo "============================================================"
  echo "  OrbStack K8s + ArgoCD Bootstrap"
  echo "============================================================"
  echo ""

  phase1_prerequisites
  phase2_cluster_check
  phase3_install_argocd
  phase4_appproject
  phase5_applications
  phase6_validation
  print_summary
}

main "$@"