apiVersion: core.oam.dev/v1beta1
kind: WorkflowStepDefinition
metadata:
  name: register-cluster
  namespace: vela-system
spec:
  schematic:
    cue:
      template: |
        import ("vela/op")

        clusterrole: op.#Apply & {
        	value: {
        		apiVersion: "rbac.authorization.k8s.io/v1"
        		kind:       "ClusterRole"
        		metadata: {
        			name: "cluster-register"
        		}
        		rules: [{
        			apiGroups: [""]
        			resources: ["configmaps", "namespaces", "serviceaccounts", "services", "secrets"]
        			verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
        		}, {
        			apiGroups: ["", "events.k8s.io"]
        			resources: ["events"]
        			verbs: ["create", "update", "patch"]
        		}, {
        			apiGroups: ["rbac.authorization.k8s.io"]
        			resources: ["clusterrolebindings", "rolebindings"]
        			verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
        		}, {
        			apiGroups: ["rbac.authorization.k8s.io"]
        			resources: ["clusterroles", "roles"]
        			verbs: ["create", "get", "list", "update", "watch", "patch", "delete", "escalate", "bind"]
        		}, {
        			apiGroups: ["rbac.authorization.k8s.io"]
        			resources: ["clusterroles", "roles"]
        			verbs: ["create", "get", "list", "update", "watch", "patch", "delete", "escalate", "bind"]
        		}, {
        			apiGroups: ["certificates.k8s.io"]
        			resources: ["certificatesigningrequests"]
        			verbs: ["create", "get", "list", "watch"]
        		}, {
        			apiGroups: ["certificates.k8s.io"]
        			resources: ["certificatesigningrequests/approval"]
        			verbs: ["update"]
        		}, {
        			apiGroups: ["certificates.k8s.io"]
        			resources: ["signers"]
        			resourceNames: ["kubernetes.io/*"]
        			verbs: ["approve"]
        		}, {
        			apiGroups: ["cluster.open-cluster-management.io"]
        			resources: ["managedclusters"]
        			verbs: ["create", "get", "list", "update", "watch", "delete"]
        		}, {
        			apiGroups: ["register.open-cluster-management.io"]
        			resources: ["managedclusters", "managedclusters/accept"]
        			verbs: ["create", "get", "list", "update", "watch", "delete"]
        		}]
        	}
        }

        serviceaccount: op.#Apply & {
        	value: {
        		apiVersion: "v1"
        		kind:       "ServiceAccount"
        		metadata: {
        			name:      "cluster-register"
        			namespace: "default"
        		}
        	}
        }

        rolebinding: op.#Apply & {
        	value: {
        		apiVersion: "rbac.authorization.k8s.io/v1"
        		kind:       "ClusterRoleBinding"
        		metadata: {
        			name: "cluster-register"
        		}
        		roleRef: {
        			apiGroup: "rbac.authorization.k8s.io"
        			kind:     "ClusterRole"
        			name:     "cluster-register"
        		}
        		subjects: [{
        			kind:      "ServiceAccount"
        			name:      "cluster-register"
        			namespace: "default"
        		}]
        	}
        }

        register: op.#Apply & {
        	value: {
        		apiVersion: "batch/v1"
        		kind:       "Job"
        		metadata: {
        			name:      "cluster-register"
        			namespace: "default"
        		}
        		spec: {
        			template: {
        				spec: {
        					containers: [{
        						name:            "cluster-register"
        						image:           "oamdev/cluster-register:v1.0"
        						imagePullPolicy: "Always"
        						command: [
        							"/app", "--cluster-name=" + "\(parameter.connInfo.clusterName)",
        							"--hub-api-server=" + "\(parameter.hubAPIServer)",
        							"--cluster-ca-cert=" + "\(parameter.connInfo.clusterCACert)",
        							"--client-cert=" + "\(parameter.connInfo.clientCert)",
        							"--client-key=" + "\(parameter.connInfo.clientKey)",
        							"--api-server-internet=" + "\(parameter.connInfo.clusterAPIServer)",
        							"--kube-config=" + "\(parameter.connInfo.kubeConfig)",
        						]
        					}]
        					restartPolicy:      "OnFailure"
        					serviceAccountName: "cluster-register"
        				}
        			}
        		}
        	}
        }

        wait: op.#ConditionalWait & {
        	continue: register.value.status.succeeded == 1
        }

        clusterSet: op.#Apply & {
        	value: {
        		apiVersion: "cluster.open-cluster-management.io/v1alpha1"
        		kind:       "ManagedClusterSet"
        		metadata: name: parameter.env
        	}
        }

        clusterSetBinding: op.#Apply & {
        	value: {
        		apiVersion: "cluster.open-cluster-management.io/v1alpha1"
        		kind:       "ManagedClusterSetBinding"
        		metadata: {
        			name:      parameter.env
        			namespace: parameter.initNameSpace
        		}
        		spec: clusterSet: parameter.env
        	}
        }

        managedCluster: op.#Read & {
        	value: {
        		apiVersion: "cluster.open-cluster-management.io/v1"
        		kind:       "ManagedCluster"
        		metadata: {
        			name: parameter.connInfo.clusterName
        		}
        	}
        }

        patchManagedCluster: op.#Apply & {
        	value: {
        		managedCluster.value
        		metadata: labels: {
        			"cluster.open-cluster-management.io/clusterset": parameter.env
        		}
        		metadata: labels: parameter.patchLabels
        	}
        }

        parameter: {
        	env:           string
        	initNameSpace: *"default" | string
        	patchLabels: [string]: string
        	hubAPIServer: *"" | string
        	connInfo: {
        		clusterName:      string
        		clusterCACert:    *"" | string
        		clientCert:       *"" | string
        		clientKey:        *"" | string
        		clusterAPIServer: *"" | string
        		kubeConfig:       *"" | string
        	}
        }






