#!/usr/bin/env bash
# Refreshes the tenant admin kubeconfig from the stored sign-in cookie, then
# mints a fresh scoped runner kubeconfig. Run by a systemd timer.
#
# STATE_DIR holds cookies.json and the tenant admin kubeconfig. The cookie
# comes from one interactive `tenant-kubeconfig.sh` sign-in; if it expires,
# run that again with FORCE_SIGNIN=1.
set -euo pipefail

ROOT=$(cd "$(dirname "$0")/.." && pwd)
STATE_DIR=${STATE_DIR:-/etc/knotless}
CLUSTER=${CLUSTER:-knotless-poc}
OUT=${OUT:-/etc/knotless/tenant.kubeconfig}

mkdir -p "$STATE_DIR"
chmod 0700 "$STATE_DIR"
export STATE_DIR NO_CREATE=1 TENANT_TTL=${TENANT_TTL:-86400} CLUSTER
ADMIN=$(STATE_DIR="$STATE_DIR" CLUSTER="$CLUSTER" NO_CREATE=1 TENANT_TTL="$TENANT_TTL" \
  "$ROOT/scripts/tenant-kubeconfig.sh")
ADMIN_KUBECONFIG="$ADMIN" OUT="$OUT" NAMESPACE=${NAMESPACE:-knotless-runs} \
  "$ROOT/scripts/scoped-kubeconfig.sh"