#!/bin/bash

# A script to automate some parts of new certificate deployment.
#
# See http://go/skia-ssl-cert for a longer description and the command you need
# to run before running this script.
#
# This script adds a new cert to gcloud, and makes a local change to the
# skia-ingress.yaml file. Applying the change to kubernetes, pushing the change
# in git, and deleting old certs are left as manual steps to allow for manual
# inspection of the change.

DATE=$(date +%Y-%m-%d)

gcloud compute ssl-certificates create skia-org-$DATE \
    --private-key=$HOME/ssl-cert-requests/WILDCARD.skia.org-$DATE/WILDCARD.skia.org.key \
    --certificate=$HOME/ssl-cert-requests/WILDCARD.skia.org-$DATE/WILDCARD.skia.org.chained.pem \
    --project=skia-public

git clone https://skia.googlesource.com/skia-public-config

sed --in-place s#ingress.gcp.kubernetes.io/pre-shared-cert:.*#ingress.gcp.kubernetes.io/pre-shared-cert:\ skia-org-$DATE# ./skia-public-config/skia-ingress.yaml

printf "\n\nConfirm that the change to skia-ingress.yaml makes sense:\n\n"

cd skia-public-config; git diff

printf "\n\nThen apply the modified yaml file after checking that you are working in skia-public:\n\n"
printf "  kubectl apply -f ./skia-public-config/skia-ingress.yaml\n\n"
printf "And commit and push the updated config file.\n\n"
printf "  cd skia-public-config; git add --all; git commit -m 'Update skia.org certs on $DATE'; git push\n\n"

printf "Also remove unused certs: \n\n"
gcloud compute ssl-certificates list --project=skia-public --format=json | jq '.[].name' | grep --invert-match skia-org-$DATE | xargs -L1 echo "  " gcloud compute ssl-certificates delete --project=skia-public