up

#!/bin/bash
# Assumes gcloud and kubectl is already installed
# THE CLUSTER NAME WILL BE THE NAME OF THE REGION AND CLUSTER ITSELF

displayHelp() {
  echo "Usage: $0 [option...]" >&2
  echo
  echo "   -p, --project-id         Your google cloud project ID (optional - defaults to current project)"
  echo "   -r, --region             Specify the region to deploy the cluster. (optional - default is us-east1)"
  echo "   -m, --machine-type       Specify the machine type (optional - default is c2-standard-4)"
  echo "   -q, --quiet              Specify the quiet flag for non-interacive (optional - default interactive mode)"
  echo
  echo "   Example:"
  echo "   New cluster:             $0 -p my-project -r us-central1 -m n1-standard-2"
  echo "   Interactive mode: $0"
  echo
  exit 1
}

addFirewallRules() {
  FIREWALL_SIP_EXISTS=$(gcloud compute firewall-rules list --format=json | grep "external-sip")
  if [ -z "$FIREWALL_SIP_EXISTS" ]; then
    echo "Creating external-sip firewall rule"
    gcloud compute firewall-rules create "external-sip" --allow=tcp:5060,udp:5060 --description="Allow SIP related traffic" --direction=INGRESS --source-ranges="0.0.0.0/0" --target-tags="external-sip"
  else
    echo "external-sip firewall rule already exists"
  fi

  FIREWALL_RTP_EXISTS=$(gcloud compute firewall-rules list --format=json | grep "external-rtp")
  if [ -z "$FIREWALL_RTP_EXISTS" ]; then
    echo "Creating external-rtp firewall rule"
    gcloud compute firewall-rules create "external-rtp" --allow=udp:10000-60000 --description="Allow RTP related traffic" --direction=INGRESS --source-ranges="0.0.0.0/0" --target-tags="external-rtp"
  else
    echo "external-rtp firewall rule already exists"
  fi
}

createCerts() {
  # Get a list of domains that we want to enable for SSL
  # This list comes from a line in the ingress/mci.yaml file
  DOMAINS=$(cat ingress/mci.yaml | grep "pre-shared-certs" | grep -o -E '"(.*?)"' | tr -d '"' | tr -d ',')
  DOMAINCOUNT=$(echo $DOMAINS | wc -w)

  # If we have any domains, loop through them and create a certificate for each
  if [ $DOMAINCOUNT -gt 0 ]; then
    for DOMAIN in $DOMAINS; do
      # Replace the - with . in the domain name
      DOMAIN_REPLACE=$(echo $DOMAIN | sed 's/-/\./g')
      # Create the certificate
      gcloud compute ssl-certificates create $DOMAIN --domains=$DOMAIN_REPLACE --global  
    done
  fi
}

createCluster() {
  echo "Creating cluster..."
  # First make sure we delete any old hub memberships by that name
  gcloud container fleet memberships delete --quiet $REGION
  # Remove any kubeconfig clusters by that cluster name
  kubectl config delete-context $REGION

  # Create the cluster
  gcloud beta container --project "$PROJECT_ID" clusters create "$REGION" --zone "$ZONE" --no-enable-basic-auth --cluster-version "1.29" --release-channel "None" --machine-type "$MACHINE_TYPE" --image-type "COS_CONTAINERD" --disk-type "pd-ssd" --disk-size "100" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" --tags "worker,$REGION" --max-pods-per-node "110" --num-nodes "3" --logging=SYSTEM,WORKLOAD --monitoring=SYSTEM --enable-ip-alias --network "projects/$PROJECT_ID/global/networks/default" --subnetwork "projects/$PROJECT_ID/regions/$REGION/subnetworks/default" --no-enable-intra-node-visibility --default-max-pods-per-node "110" --enable-autoscaling --min-nodes "3" --max-nodes "10" --enable-dataplane-v2 --no-enable-master-authorized-networks --addons HorizontalPodAutoscaling,HttpLoadBalancing,GcePersistentDiskCsiDriver --no-enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 --autoscaling-profile optimize-utilization --workload-pool "$PROJECT_ID.svc.id.goog" --maintenance-window-start "2023-02-19T04:00:00Z" --maintenance-window-end "2023-02-19T08:00:00Z" --maintenance-window-recurrence "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR,SA,SU" --enable-shielded-nodes --node-locations "$ZONE" --cluster-dns clouddns --cluster-dns-scope vpc --cluster-dns-domain $REGION
  # Add the external-rtp node pool to the cluster
  gcloud beta container --project "$PROJECT_ID" node-pools create "external-rtp" --cluster "$REGION" --zone "$ZONE" --machine-type "$MACHINE_TYPE" --image-type "UBUNTU_CONTAINERD" --disk-type "pd-ssd" --disk-size "100" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" --num-nodes "1" --no-enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 --tags "external-rtp,$REGION" --enable-autoscaling --min-nodes "1" --max-nodes "2" --node-locations "$ZONE"
  # Add the external-sip node pool to the cluster
  gcloud beta container --project "$PROJECT_ID" node-pools create "external-sip" --cluster "$REGION" --zone "$ZONE" --machine-type "$MACHINE_TYPE" --image-type "UBUNTU_CONTAINERD" --disk-type "pd-ssd" --disk-size "100" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" --num-nodes "1" --no-enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 --tags "external-sip,$REGION" --node-locations "$ZONE"
  # Add the internal-media node pool to the cluster
  gcloud beta container --project "$PROJECT_ID" node-pools create "internal-media" --cluster "$REGION" --zone "$ZONE" --machine-type "$MACHINE_TYPE" --image-type "UBUNTU_CONTAINERD" --disk-type "pd-ssd" --disk-size "100" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" --num-nodes "1" --no-enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 --tags "internal-media,$REGION" --enable-autoscaling --min-nodes "1" --max-nodes "10" --node-locations "$ZONE"

  # Create GKE Multi Cluster Service stuff
  gcloud services enable gkehub.googleapis.com multiclusterservicediscovery.googleapis.com dns.googleapis.com trafficdirector.googleapis.com cloudresourcemanager.googleapis.com --project $PROJECT_ID
  gcloud container fleet multi-cluster-services enable --project $PROJECT_ID
  gcloud container fleet memberships register $REGION --gke-cluster "$ZONE/$REGION" --enable-workload-identity --project $PROJECT_ID
  gcloud projects add-iam-policy-binding $PROJECT_ID --member "serviceAccount:$PROJECT_ID.svc.id.goog[gke-mcs/gke-mcs-importer]" --role "roles/compute.networkViewer"

  # Get cluster context and rename it to the cluster name
  gcloud container clusters get-credentials $REGION --zone=$ZONE
  kubectl config rename-context gke_"$PROJECT_ID"_"$ZONE"_"$REGION" $REGION
}

applySecrets() {
  echo "Applying secrets..."

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: api-auth-secret
  namespace: $1
type: Opaque
stringData:
  authSecret: $(gcloud secrets versions access latest --secret=api-auth-secret | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: google-service-account
  namespace: $1
type: Opaque
stringData:
  key.json: |
    $(gcloud secrets versions access latest --secret=google-service-account | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: nats-token
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=nats-token)

---

apiVersion: v1
kind: Secret
metadata:
  name: regcred
  namespace: $1
stringData:
  .dockerconfigjson: |
    $(gcloud secrets versions access latest --secret=regcred | grep -m1 "")
type: kubernetes.io/dockerconfigjson

---

apiVersion: v1
kind: Secret
metadata:
  name: mysql-url
  namespace: $1
type: Opaque
stringData:
  connectionString: $(gcloud secrets versions access latest --secret=mysql-url | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: gcloud-mysql-url
  namespace: $1
type: Opaque
stringData:
  connectionString: $(gcloud secrets versions access latest --secret=gcloud-mysql-url | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: aws
  namespace: $1
type: Opaque
stringData:
  accessKey: $(gcloud secrets versions access latest --secret=aws | cut -d':' -f1)
  secretAccessKey: $(gcloud secrets versions access latest --secret=aws | cut -d':' -f2)

---

apiVersion: v1
kind: Secret
metadata:
  name: mysql-root-pw
  namespace: $1
type: Opaque
stringData:
  pw: $(gcloud secrets versions access latest --secret=mysql-root-pw | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: apiban-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=apiban-key | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: prometheus-password
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=prometheus-password | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: loki-password
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=loki-password | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: slack-webhook-url
  namespace: $1
type: Opaque
stringData:
  webhook-url: $(gcloud secrets versions access latest --secret=slack-webhook-url | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: consul-address
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=consul-address | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: consul-token
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=consul-token | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: openai-api-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=openai-api-key | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: r2-worker-api-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=r2-worker-api-key | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: r2
  namespace: $1
type: Opaque
stringData:
  accessKey: $(gcloud secrets versions access latest --secret=r2 | cut -d':' -f1)
  secretAccessKey: $(gcloud secrets versions access latest --secret=r2 | cut -d':' -f2)

---

apiVersion: v1
kind: Secret
metadata:
  name: google-sso-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=google-sso-key | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: google-sso-secret
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=google-sso-secret | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: express-sso-session-secret
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=express-sso-session-secret | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: azure-ad-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=azure-ad-key | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: azure-ad-secret
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=azure-ad-secret | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: deepgram-api-key
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=deepgram-api-key | cut -d':' -f1)

---

apiVersion: v1
kind: Secret
metadata:
  name: hono-session-secret
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=hono-session-secret | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: rtpagent-license
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=rtpagent-license | grep -m1 "")

---

apiVersion: v1
kind: Secret
metadata:
  name: fastify-session-secret
  namespace: $1
type: Opaque
stringData:
  key: $(gcloud secrets versions access latest --secret=fastify-session-secret)

EOF
}

deployResources() {
  echo "Deploying resources..."
  
  # deploy pre-reqs (order is important)
  kubectl apply -f namespace
  kubectl apply -f rbac
  applySecrets "$NAMESPACE"
  kubectl apply -f pdb.yaml

  # Get the subnet of the current region (which will be unique)
  SUBNET=$(gcloud compute networks subnets describe default --region=$REGION | grep "gatewayAddress" | awk -F '.' '{print $2}')
  SERVER_ID=\"$SUBNET\"

# Create cluster-details ConfigMap
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-details
  namespace: $NAMESPACE
data:
  projectId: $PROJECT_ID
  serverId: $SERVER_ID
  clusterName: $REGION
  zone: $ZONE
EOF

  # Set kubeconfig
  kubectl config use $REGION
  echo "kubeconfig set to $REGION"

  # Deploy NATS (because everything needs it)
  kubectl apply -f nats
  sleep 2
  kubectl -n $NAMESPACE wait --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=nats-0 --timeout=300s
  kubectl -n $NAMESPACE wait --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=nats-1 --timeout=300s
  kubectl -n $NAMESPACE wait --for=condition=ready pod -l statefulset.kubernetes.io/pod-name=nats-2 --timeout=300s

  # Check if we are deploying the CONFIG_REGION
  if [ "$CONFIG_REGION" == "1" ]; then
    # Deploy ingress
    gcloud container fleet ingress enable --config-membership=$REGION

    echo "Sleeping 30 seconds..."
    sleep 30

    # Deploy MultiClusterService, MultiClusterIngress
    kubectl apply -f ingress
  fi

  # Deploy Proxysql
  kubectl apply -f proxysql
  sleep 2
  kubectl -n $NAMESPACE wait --for=condition=available deploy/proxysql --timeout=300s

  # Deploy all other services (order is important)
  kubectl apply -f jobs
  sleep 2
  kubectl -n $NAMESPACE wait --for=condition=available deploy/jobs --timeout=300s

  kubectl apply -f omnia-api
  kubectl apply -f voxo-api

  kubectl apply -f rtpengine
  sleep 10
  kubectl -n $NAMESPACE wait --for=condition=available deploy/rtpengine --timeout=300s

  kubectl apply -f asterisk
  sleep 2
  kubectl -n $NAMESPACE wait --for=condition=available deploy/ast --timeout=300s

  kubectl apply -f kamailio

  kubectl apply -f monitor-agent
}

# Get args
while [[ "$#" -gt 0 ]]; do
  case $1 in
    -p|--project-id) PROJECT_ID="$2"; shift ;;
    -r|--region) REGION="$2"; shift ;;
    -m|--machine-type) MACHINE_TYPE="$2"; shift ;;
    -q|--quiet) QUIET="$2"; shift ;;
    -h|--help) displayHelp; exit 0 ;;
    *) echo "Unknown parameter passed: $1"; exit 1 ;;
  esac
  shift
done

# Set a default project id if not set
if [ -z "$PROJECT_ID" ]; then
  PROJECT_ID=$(gcloud config get-value project)
fi

# Set a default machine type if it isn't set
if [ -z "$MACHINE_TYPE" ]; then
  MACHINE_TYPE="c2-standard-4"
fi

# Set a default namespace
NAMESPACE="production"

# Set a default region if it isn't set
if [ -z "$REGION" ]; then
  REGION="us-east1"
fi

# Set the default zone if it isn't set
if [ -z "$ZONE" ]; then
  ZONE="$REGION-b"
fi

# Check if quiet flag as a value
if [ -z "$QUIET" ]; then
  QUIET=0
  
  # Ask for project-id
  read -p "Project ID [$PROJECT_ID]: " PROJECT_ID
  PROJECT_ID=${PROJECT_ID:-$(gcloud config get-value project)}
  echo Selected Project ID: "$PROJECT_ID"

  # Ask for region filtered by region in the US
  REGION_NAMES=(us-west1 us-west2 us-west3 us-west4 us-central1 us-east1 us-east4 us-east5 us-south1)
  SELECTED_REGION=()
  PS3='Select a region: '
  select name in "${REGION_NAMES[@]}" ; do
    for reply in $REPLY ; do
        SELECTED_REGION+=(${REGION_NAMES[reply - 1]})
    done
    [[ $SELECTED_REGION ]] && break
  done
  REGION=${SELECTED_REGION[0]}
  ZONE="$REGION-b"
  echo Selected region: "${SELECTED_REGION[@]}"

  # Ask for machine type
  MACHINE_TYPES=(n2-standard-2 n2-standard-4 n2-standard-8 n2-standard-16 n2-standard-32 c2-standard-4 c2-standard-8 c2-standard-16 c2-standard-30)
  SELECTED_MACHINE_TYPE=()
  PS3='Select a machine type: '
  select name in "${MACHINE_TYPES[@]}" ; do
    for reply in $REPLY ; do
        SELECTED_MACHINE_TYPE+=(${MACHINE_TYPES[reply - 1]})
    done
    [[ $SELECTED_MACHINE_TYPE ]] && break
  done
  MACHINE_TYPE=${SELECTED_MACHINE_TYPE[0]}
  echo Selected machine type: "${SELECTED_MACHINE_TYPE[@]}"
fi

# Sanity check to make sure the cluster doesn't already exist
CLUSTER_EXISTS=$(gcloud container clusters list --format=json | grep "$REGION")
if [ -n "$CLUSTER_EXISTS" ]; then
  echo "Cluster $REGION already exists"
  displayHelp
  exit 1
fi

# Figure out which cluster is the config region for multi cluster ingress
# If the current region is the config region, then we need to deploy the ingress and certs
CONFIG_REGION=0

# Get MultiClusterIngress status
MCISTATUS=$(gcloud container fleet ingress describe --format 'get(state.state.code)')
# Get the current config region
CURRENT_CONFIG_REGION=$(gcloud container fleet ingress describe --format 'get(spec.multiclusteringress.configMembership)' | rev | cut -d '/' -f1 | rev)
# Check if the current config region actually exists
CONFIG_REGION_EXISTS=$(gcloud container clusters list --format=json | grep "$CURRENT_CONFIG_REGION")
if [ -z "$CONFIG_REGION_EXISTS" ]; then
  echo "Config region cluster $CURRENT_CONFIG_REGION doesn't even exist..."
  # Blow away the ingress hub for the dead cluster
  gcloud container fleet memberships delete --quiet $CURRENT_CONFIG_REGION
  gcloud container fleet ingress update --config-membership=$REGION --quiet
  # Set current config region to myself
  CURRENT_CONFIG_REGION=$REGION
  CONFIG_REGION=1
fi
if [ "$MCISTATUS" == "OK" ] && [ "$CURRENT_CONFIG_REGION" == "$REGION" ]; then
  # Config region is myself
  CONFIG_REGION=1
fi
if [ "$MCISTATUS" != "OK" ]; then
  # We need to become the config region
  CONFIG_REGION=1
fi

# Ask for confirmation before continuing
echo "The following will be created:"
echo "  - Cluster: $REGION"
echo "  - Namespace: $NAMESPACE"
echo "  - Machine Type: $MACHINE_TYPE"
echo "  - Project: $PROJECT_ID"
echo "  - Deploying Config Region: $CONFIG_REGION"
echo "  - Current MCI Config Region: $CURRENT_CONFIG_REGION"
echo "  - Creating Certs: $CONFIG_REGION"

# Check if QUIET is not 0. If it is, then we don't ask for confirmation
if [ "$QUIET" == "0" ]; then
  read -p "Continue (y/n)? " choice
  case "$choice" in
    y|Y ) echo "Continuing";;
    n|N ) echo "Exiting"; exit 1 ;;
    * ) echo "Invalid. Exiting"; exit 1 ;;
  esac
fi

# Create firewall rules for external-sip and external-udp tagged Node Pool(s)
addFirewallRules

# Create certs
if [ "$CONFIG_REGION" == "1" ]; then
  createCerts
fi

# Create the cluster
createCluster

# Deploy resources
deployResources

echo "DONE DEPLOYING $REGION"