Configure Consul Connect with Kubernetes integration for secure service mesh communication

#!/usr/bin/env bash

set -euo pipefail

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration variables
CONSUL_NAMESPACE="consul"
KUBECTL_VERSION=""
CLEANUP_ON_FAILURE=true

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -n, --namespace NAME    Consul namespace (default: consul)"
    echo "  --no-cleanup           Don't cleanup on failure"
    echo "  -h, --help             Show this help message"
    exit 1
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -n|--namespace)
            CONSUL_NAMESPACE="$2"
            shift 2
            ;;
        --no-cleanup)
            CLEANUP_ON_FAILURE=false
            shift
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            ;;
    esac
done

# Cleanup function for rollback
cleanup() {
    if [ "$CLEANUP_ON_FAILURE" = true ]; then
        echo -e "${YELLOW}[CLEANUP] Rolling back due to failure...${NC}"
        kubectl delete namespace "$CONSUL_NAMESPACE" --ignore-not-found=true 2>/dev/null || true
        helm repo remove hashicorp 2>/dev/null || true
    fi
}

# Set trap for cleanup on error
trap cleanup ERR

# Function to print colored status messages
print_status() {
    echo -e "${BLUE}$1${NC}"
}

print_success() {
    echo -e "${GREEN}$1${NC}"
}

print_error() {
    echo -e "${RED}$1${NC}"
}

print_warning() {
    echo -e "${YELLOW}$1${NC}"
}

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -eq 0 ]]; then
        SUDO=""
    elif command -v sudo >/dev/null 2>&1; then
        SUDO="sudo"
        # Test sudo access
        if ! $SUDO -n true 2>/dev/null; then
            print_error "This script requires sudo privileges. Please run with sudo or as root."
            exit 1
        fi
    else
        print_error "This script requires root privileges or sudo access."
        exit 1
    fi
}

# Detect Linux distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                PKG_UPGRADE="apt upgrade -y"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf check-update || true"
                PKG_INSTALL="dnf install -y"
                PKG_UPGRADE="dnf upgrade -y"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum check-update || true"
                PKG_INSTALL="yum install -y"
                PKG_UPGRADE="yum upgrade -y"
                ;;
            *)
                print_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        print_error "Cannot detect Linux distribution"
        exit 1
    fi
}

# Check prerequisites
check_prerequisites() {
    print_status "[1/8] Checking prerequisites..."
    
    check_privileges
    detect_distro
    
    # Check if Kubernetes cluster is accessible
    if command -v kubectl >/dev/null 2>&1; then
        if ! kubectl cluster-info >/dev/null 2>&1; then
            print_warning "kubectl is installed but cannot connect to cluster. Continuing with installation..."
        fi
    fi
    
    print_success "Prerequisites check completed"
}

# Update system packages
update_system() {
    print_status "[2/8] Updating system packages..."
    
    $SUDO $PKG_UPDATE
    $SUDO $PKG_UPGRADE
    $SUDO $PKG_INSTALL curl wget gnupg
    
    # Install additional packages based on distro
    case "$PKG_MGR" in
        apt)
            $SUDO $PKG_INSTALL lsb-release apt-transport-https ca-certificates
            ;;
        dnf|yum)
            $SUDO $PKG_INSTALL which
            ;;
    esac
    
    print_success "System packages updated"
}

# Install kubectl
install_kubectl() {
    print_status "[3/8] Installing kubectl..."
    
    if command -v kubectl >/dev/null 2>&1; then
        print_warning "kubectl already installed, skipping..."
        return
    fi
    
    KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt)
    curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
    chmod 755 kubectl
    $SUDO mv kubectl /usr/local/bin/
    
    # Verify installation
    if kubectl version --client >/dev/null 2>&1; then
        print_success "kubectl installed successfully"
    else
        print_error "kubectl installation failed"
        exit 1
    fi
}

# Install Helm
install_helm() {
    print_status "[4/8] Installing Helm..."
    
    if command -v helm >/dev/null 2>&1; then
        print_warning "Helm already installed, skipping..."
        return
    fi
    
    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
    
    # Verify installation
    if helm version >/dev/null 2>&1; then
        print_success "Helm installed successfully"
    else
        print_error "Helm installation failed"
        exit 1
    fi
}

# Setup Helm repository
setup_helm_repo() {
    print_status "[5/8] Setting up HashiCorp Helm repository..."
    
    helm repo add hashicorp https://helm.releases.hashicorp.com
    helm repo update
    
    print_success "HashiCorp Helm repository added"
}

# Create Consul namespace
create_namespace() {
    print_status "[6/8] Creating Consul namespace..."
    
    if kubectl get namespace "$CONSUL_NAMESPACE" >/dev/null 2>&1; then
        print_warning "Namespace $CONSUL_NAMESPACE already exists, skipping..."
    else
        kubectl create namespace "$CONSUL_NAMESPACE"
        print_success "Namespace $CONSUL_NAMESPACE created"
    fi
}

# Deploy Consul Connect
deploy_consul() {
    print_status "[7/8] Deploying Consul Connect..."
    
    # Create Consul values file
    cat > /tmp/consul-values.yaml << 'EOF'
global:
  name: consul
  datacenter: dc1
  tls:
    enabled: true
    enableAutoEncrypt: true
  acls:
    manageSystemACLs: true
  gossipEncryption:
    autoGenerate: true

server:
  replicas: 3
  storage: 10Gi
  resources:
    requests:
      memory: 100Mi
      cpu: 100m
    limits:
      memory: 100Mi
      cpu: 100m

client:
  enabled: true
  resources:
    requests:
      memory: 100Mi
      cpu: 100m
    limits:
      memory: 100Mi
      cpu: 100m

connectInject:
  enabled: true
  default: false
  transparentProxy:
    defaultEnabled: true
  resources:
    requests:
      memory: 50Mi
      cpu: 50m
    limits:
      memory: 50Mi
      cpu: 50m

controller:
  enabled: true

meshGateway:
  enabled: true
  replicas: 1
  resources:
    requests:
      memory: 100Mi
      cpu: 100m
    limits:
      memory: 100Mi
      cpu: 100m

ui:
  enabled: true
  service:
    type: LoadBalancer
EOF

    # Install Consul
    helm install consul hashicorp/consul --namespace "$CONSUL_NAMESPACE" --values /tmp/consul-values.yaml
    
    # Wait for deployment
    print_status "Waiting for Consul pods to be ready (timeout: 300s)..."
    kubectl wait --for=condition=ready pod --all -n "$CONSUL_NAMESPACE" --timeout=300s
    
    # Clean up values file
    rm -f /tmp/consul-values.yaml
    
    print_success "Consul Connect deployed successfully"
}

# Verify installation
verify_installation() {
    print_status "[8/8] Verifying installation..."
    
    # Check pod status
    echo "Consul pods status:"
    kubectl get pods -n "$CONSUL_NAMESPACE"
    
    # Check services
    echo -e "\nConsul services:"
    kubectl get svc -n "$CONSUL_NAMESPACE"
    
    # Check if Consul UI service exists
    if kubectl get svc consul-ui -n "$CONSUL_NAMESPACE" >/dev/null 2>&1; then
        echo -e "\n${GREEN}Consul UI is available. To access it:${NC}"
        echo "kubectl port-forward svc/consul-ui 8080:80 -n $CONSUL_NAMESPACE"
        echo "Then visit: http://localhost:8080"
    fi
    
    print_success "Installation verification completed"
}

# Main execution
main() {
    echo -e "${GREEN}Starting Consul Connect with Kubernetes installation...${NC}"
    
    check_prerequisites
    update_system
    install_kubectl
    install_helm
    setup_helm_repo
    create_namespace
    deploy_consul
    verify_installation
    
    # Disable cleanup trap on success
    trap - ERR
    
    echo -e "${GREEN}"
    echo "=========================================="
    echo "Consul Connect installation completed!"
    echo "=========================================="
    echo -e "${NC}"
    echo "Next steps:"
    echo "1. Create service intentions for service-to-service communication"
    echo "2. Deploy applications with connect-inject annotations"
    echo "3. Configure service mesh policies as needed"
    echo ""
    echo "For more information, visit: https://www.consul.io/docs/connect"
}

main "$@"