1import * as _ from 'lodash-es'
2import { CoreV1Api } from '@kubernetes/client-node'
3import { getKubeApis } from './getApisF.mts'
4import { throPtErr } from '../../sharedF/throwErrorF/sharedErrF.mts'
5import { getKlusterCtx } from './ctxF/klusterCtxF.mts'
6import type { WithClusterName } from './ctxF/klusterCtxF.mts'
7import { isCertReady } from './initialSetupF/certmanager/leWcCertF.mts'
8import type { KubernetesObject } from '@kubernetes/client-node'
9
10type CheckIngressProps = WithClusterName & { resources: KubernetesObject[] }
11
12export const checkIngressTlsSecretsExist = async ({resources, cluster_name}: CheckIngressProps) => {
13  const ingresses = _.filter(resources, {kind: 'Ingress'})
14  if (ingresses.length === 0) return
15
16  const wcCertNames = Object.keys(getKlusterCtx().klustCertsH || {})
17  const { kubeConfig } = await getKubeApis({ cluster_name })
18  const coreApi = kubeConfig.makeApiClient(CoreV1Api)
19
20  for (const ingress of ingresses) {
21    const namespace = (ingress.metadata?.namespace || 'default') as string
22    const tlsEntries = (ingress as {spec?: {tls?: {secretName?: string}[]}}).spec?.tls || []
23    const secretNames = _.compact(_.map(tlsEntries, 'secretName'))
24
25    if (secretNames.length === 0) continue
26
27    const { items: secrets } = await coreApi.listNamespacedSecret({namespace})
28    const existingSecretNames = _.map(secrets, 'metadata.name')
29
30    const missingSecrets = _.filter(secretNames, (name) => !existingSecretNames.includes(name))
31
32    if (missingSecrets.length > 0) {
33      throPtErr(`Missing TLS secrets: ${missingSecrets.join(', ')}. Uncomment & run k8sCerts() first.`, {
34        missingSecrets,
35        namespace,
36        ingressName: ingress.metadata?.name,
37      })
38    }
39
40    for (const name of secretNames.filter((n) => wcCertNames.includes(n))) {
41      if (!await isCertReady({name, namespace, cluster_name})) {
42        throPtErr(`Wildcard TLS cert '${name}' is not Ready. Ensure k8sCerts (+ awaitCertsReady) ran for this cluster.`, {
43          certName: name, namespace, ingressName: ingress.metadata?.name,
44        })
45      }
46    }
47  }
48}
49