#!/bin/bash
set -eu
export KUBECONFIG=/root/.kube/config
cat > /usr/cluster/vault/unseal.sh << 'EOF'
#!/bin/bash
set -eu
export KUBECONFIG=/root/.kube/config
key=$(python3 -c 'import json; print(json.load(open("/usr/cluster/vault/init.json"))["unseal_keys_b64"][0], end="")')
kubectl -n vault exec vault-0 -- vault operator unseal "$key" >/tmp/vault-unseal.out
rm -f /tmp/vault-unseal.out
kubectl -n vault exec vault-0 -- vault status -format=json | python3 -c 'import json,sys; d=json.load(sys.stdin); print("initialized", d.get("initialized"), "sealed", d.get("sealed"))'
EOF
chmod 700 /usr/cluster/vault/unseal.sh
chmod 600 /usr/cluster/vault/init.json
echo "=== PERMS ==="
ls -l /usr/cluster/vault/init.json /usr/cluster/vault/unseal.sh
echo "=== DF ==="
df -h /usr/cluster/vault/data
echo "=== APPS ==="
kubectl get deploy -n llm -n dify --no-headers 2>/dev/null || true
kubectl get deploy -n llm
kubectl get deploy -n dify
echo "=== HEALTH ==="
curl -s -o /dev/null -m 8 -w "vllm %{http_code}\n" http://127.0.0.1:8000/health || echo vllm_err
supervisorctl status
echo "=== ESO ==="
mkdir -p /usr/cluster/k8s/charts
if curl -fL --retry 2 --connect-timeout 15 --max-time 40 \
  -o /usr/cluster/k8s/charts/external-secrets-2.12.0.tgz \
  "https://ghfast.top/https://github.com/external-secrets/external-secrets/releases/download/helm-chart-2.12.0/external-secrets-2.12.0.tgz"; then
  echo ESO_TGZ_OK
  ls -lh /usr/cluster/k8s/charts/external-secrets-2.12.0.tgz
else
  echo ESO_SKIP
  rm -f /usr/cluster/k8s/charts/external-secrets-2.12.0.tgz
fi