import paramiko
import json
import base64

def main():
    # 1. Connect to Aerodrome (140.44.4.11)
    ssh_aero = paramiko.SSHClient()
    ssh_aero.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh_aero.connect('140.44.4.11', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

    print("=== STEP 1: Creating argocd-manager ServiceAccount & RBAC on Aerodrome ===")
    rb_yaml = """
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argocd-manager
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-manager-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: argocd-manager
  namespace: kube-system
---
apiVersion: v1
kind: Secret
metadata:
  name: argocd-manager-token
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: argocd-manager
type: kubernetes.io/service-account-token
"""
    stdin, stdout, stderr = ssh_aero.exec_command("kubectl apply -f -")
    stdin.write(rb_yaml)
    stdin.channel.shutdown_write()
    print("RBAC apply stdout:\n", stdout.read().decode())
    print("RBAC apply stderr:\n", stderr.read().decode())

    # Get CA cert and Token
    stdin, stdout, stderr = ssh_aero.exec_command("kubectl get secret -n kube-system argocd-manager-token -o json")
    secret_data = json.loads(stdout.read().decode())
    token = base64.b64decode(secret_data["data"]["token"]).decode('utf-8')
    ca_data = secret_data["data"]["ca.crt"]
    print(f"Obtained Aerodrome token (len: {len(token)}) and CA cert.")
    ssh_aero.close()

    # 2. Connect to Spaceport (140.44.4.41) and register cluster in ArgoCD
    ssh_sp = paramiko.SSHClient()
    ssh_sp.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh_sp.connect('140.44.4.41', username='root', key_filename=r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet', timeout=10)

    print("=== STEP 2: Creating cluster secret in Spaceport (namespace infrastructure) ===")
    config_json = json.dumps({
        "bearerToken": token,
        "tlsClientConfig": {
            "insecure": False,
            "caData": ca_data
        }
    })

    cluster_secret_yaml = f"""
apiVersion: v1
kind: Secret
metadata:
  name: cluster-aerodrome
  namespace: infrastructure
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: aerodrome
  server: https://140.44.4.11:6443
  config: |
    {config_json}
"""
    stdin, stdout, stderr = ssh_sp.exec_command("kubectl apply -f -")
    stdin.write(cluster_secret_yaml)
    stdin.channel.shutdown_write()
    print("Cluster Secret apply stdout:\n", stdout.read().decode())
    print("Cluster Secret apply stderr:\n", stderr.read().decode())

    # Verify cluster list in argocd
    stdin, stdout, stderr = ssh_sp.exec_command("kubectl get secrets -n infrastructure -l argocd.argoproj.io/secret-type=cluster")
    print("Cluster Secrets:\n", stdout.read().decode())

    ssh_sp.close()

if __name__ == '__main__':
    main()