#!/usr/bin/env bash
set -euo pipefail

K8S_MINOR="${K8S_MINOR:-v1.31}"
POD_CIDR="${POD_CIDR:-192.168.0.0/16}"
CALICO_VERSION="${CALICO_VERSION:-v3.27.0}"

if [[ "${EUID}" -eq 0 ]]; then
  SUDO=""
  TARGET_USER="${SUDO_USER:-root}"
else
  SUDO="sudo"
  TARGET_USER="${SUDO_USER:-$USER}"
fi

TARGET_HOME="$(getent passwd "${TARGET_USER}" | cut -d: -f6)"
[[ -n "${TARGET_HOME}" ]] || { echo "无法获取用户 ${TARGET_USER} 的 home"; exit 1; }

echo "[1/7] 关闭 swap"
${SUDO} swapoff -a || true
${SUDO} sed -ri '/\sswap\s/s/^#?/#/' /etc/fstab || true

echo "[2/7] 配置内核参数"
cat <<'EOF' | ${SUDO} tee /etc/modules-load.d/k8s.conf >/dev/null
overlay
br_netfilter
EOF
${SUDO} modprobe overlay || true
${SUDO} modprobe br_netfilter || true

cat <<'EOF' | ${SUDO} tee /etc/sysctl.d/k8s.conf >/dev/null
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
${SUDO} sysctl --system >/dev/null || true

echo "[3/7] 安装并配置 containerd"
${SUDO} apt-get update -y
if ! command -v containerd >/dev/null 2>&1; then
  # 优先 containerd.io（避免与 docker-ce 冲突），失败再回退 containerd
  ${SUDO} apt-get install -y containerd.io || ${SUDO} apt-get install -y containerd
fi
${SUDO} mkdir -p /etc/containerd
containerd config default | ${SUDO} tee /etc/containerd/config.toml >/dev/null
${SUDO} sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
${SUDO} systemctl restart containerd
${SUDO} systemctl enable containerd >/dev/null

echo "[4/7] 安装 kubeadm/kubelet/kubectl (${K8S_MINOR})"
${SUDO} mkdir -p /etc/apt/keyrings
curl -fsSL "https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/Release.key" \
  | ${SUDO} gpg --dearmor --batch --yes -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/ /" \
  | ${SUDO} tee /etc/apt/sources.list.d/kubernetes.list >/dev/null

${SUDO} apt-get update -y
${SUDO} apt-get install -y kubelet kubeadm kubectl
${SUDO} apt-mark hold kubelet kubeadm kubectl >/dev/null
${SUDO} systemctl enable --now kubelet >/dev/null

echo "[5/7] 初始化控制平面"
if [[ ! -f /etc/kubernetes/admin.conf ]]; then
  ${SUDO} kubeadm init --pod-network-cidr="${POD_CIDR}"
else
  echo "已检测到 /etc/kubernetes/admin.conf，跳过 kubeadm init"
fi

echo "[6/7] 配置 kubeconfig"
${SUDO} mkdir -p "${TARGET_HOME}/.kube"
${SUDO} cp -f /etc/kubernetes/admin.conf "${TARGET_HOME}/.kube/config"
${SUDO} chown -R "${TARGET_USER}:${TARGET_USER}" "${TARGET_HOME}/.kube"
export KUBECONFIG="${TARGET_HOME}/.kube/config"

echo "[7/7] 安装 CNI（Calico ${CALICO_VERSION}）"
kubectl apply -f "https://raw.githubusercontent.com/projectcalico/calico/${CALICO_VERSION}/manifests/calico.yaml"

# 单机模式允许业务 Pod 调度到控制平面
kubectl taint nodes --all node-role.kubernetes.io/control-plane- >/dev/null 2>&1 || true
kubectl taint nodes --all node-role.kubernetes.io/master- >/dev/null 2>&1 || true

kubectl get nodes -o wide

echo
echo "K8s 控制平面安装完成。"
echo "当前 kubeconfig: ${KUBECONFIG}"