# Create the parent directory for the Internal Developer Platform lab manifests
mkdir -p ~/enterprise-idp-lab/catalog
mkdir -p ~/enterprise-idp-lab/templates/skeleton
mkdir -p ~/enterprise-idp-lab/gitops
mkdir -p ~/enterprise-idp-lab/governance
mkdir -p ~/enterprise-idp-lab/scorecards
cd ~/enterprise-idp-lab
 
# Verify the directory structure was created successfully
pwd

cat << 'EOF' > catalog/vllm-catalog-info.yaml
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: vllm-inference-engine
  description: High-throughput vLLM serving engine powering enterprise fraud detection chatbots.
  labels:
    tier: ai-inference
  annotations:
    # TechDocs Governance: Render beautiful Markdown documentation directly from Git!
    backstage.io/techdocs-ref: dir:.
    github.com/project-slug: enterprise-org/vllm-inference-engine
spec:
  type: service
  lifecycle: production
  # Master Ownership Governance: Explicitly assign entity ownership to an enterprise group!
  # (Eliminates orphan microservices and ensures Incident Commanders page correct teams!)
  owner: group:ai-platform
  system: fraud-detection-system
  # C4 Model Dependency Mapping: Declare exact API and Resource dependencies!
  providesApis:
    - vllm-openapi-spec
  dependsOn:
    - resource:s3-model-registry-bucket
EOF

cat << 'EOF' > templates/vllm-scaffolder-template.yaml
apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: vllm-serving-template
  title: Deploy High-Throughput vLLM Serving Engine (Golden Path)
  description: Scaffolds a production-grade AI serving project with vLLM, S3 init containers, and KEDA autoscaling.
  tags:
    - ai
    - vllm
    - golden-path
spec:
  owner: group:ai-platform
  type: service
  # ==============================================================================
  # PARAMETERS: JSONSchema definitions rendering a beautiful Backstage Web Form!
  # ==============================================================================
  parameters:
    - title: AI Model Identification
      required:
        - model_name
        - owner
      properties:
        model_name:
          title: Model Name
          type: string
          description: Unique identifier for your AI model (e.g., llama3-70b-fraud).
        owner:
          title: Entity Owner
          type: string
          description: Enterprise engineering group responsible for this service.
          ui:field: OwnerPicker
 
  # ==============================================================================
  # STEPS: Sequential scaffolding actions executed by Backstage Scaffolder pipeline!
  # ==============================================================================
  steps:
    # STEP 1: Fetch skeleton blueprint directory and inject Nunjucks parameters!
    - id: fetch-base
      name: Fetching AI Blueprint Skeleton
      action: fetch:template
      input:
        url: ./skeleton
        values:
          model_name: ${{ parameters.model_name }}
          owner: ${{ parameters.owner }}
 
    # STEP 2: Publish rendered workspace directory to Enterprise GitHub!
    - id: publish-github
      name: Publishing to Enterprise GitHub
      action: publish:github
      input:
        allowedHosts: ['github.com']
        description: Production AI serving engine for ${{ parameters.model_name }}.
        repoUrl: github.com?owner=enterprise-org&repo=${{ parameters.model_name }}-service
 
    # STEP 3: Register brand-new catalog-info.yaml to Backstage Software Catalog!
    - id: register-catalog
      name: Registering to Backstage Catalog
      action: catalog:register
      input:
        repoContentsUrl: ${{ steps['publish-github'].output.repoContentsUrl }}
        catalogInfoPath: '/catalog-info.yaml'
EOF

cat << 'EOF' > gitops/master-appset.yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: master-multi-cluster-ai-deployer
  namespace: argocd
  labels:
    tier: gitops-delivery
spec:
  # ==============================================================================
  # GENERATORS: Matrix Generator combining Git Directories and Cluster Selectors!
  # ==============================================================================
  generators:
    - matrix:
        generators:
          # 1. Git Directory Generator: Discover new Backstage scaffolded repositories!
          - git:
              repoURL: https://github.com/enterprise-org/master-gitops-workloads.git
              revision: HEAD
              directories:
                - path: apps/*
          # 2. Cluster Generator: Target all production Kubernetes clusters!
          - clusters:
              selector:
                matchLabels:
                  tier: production
 
  # ==============================================================================
  # TEMPLATE: Master blueprint generating standard ArgoCD Application objects!
  # ==============================================================================
  template:
    metadata:
      name: '{{path.basename}}-{{name}}'
      labels:
        application: '{{path.basename}}'
        cluster: '{{name}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/enterprise-org/master-gitops-workloads.git
        targetRevision: HEAD
        path: '{{path}}'
      destination:
        server: '{{server}}'
        namespace: production
      # Master Sync Governance: Enforce automated pruning and self-healing GitOps!
      # (Eliminates configuration drift and instantly overwrites manual kubectl edits!)
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
EOF

cat << 'EOF' > governance/enterprise-cluster-policy.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: master-enterprise-security-guardrails
spec:
  # Master Admission Governance: Set validationFailureAction to Enforce!
  # (Instantly blocks non-compliant workloads from entering etcd!)
  validationFailureAction: Enforce
  background: true
  rules:
    - name: block-privileged-containers
      match:
        any:
        - resources:
            kinds:
              - Pod # Intercept all incoming Pod creation API requests!
      validate:
        # Master Developer Feedback: Define an explicit, highly instructional failure message!
        # (Displayed beautifully in ArgoCD UI so developers can fix issues without support tickets!)
        message: >-
          FATAL GOVERNANCE ALARM: Privileged containers are strictly prohibited by Enterprise Security Policy.
          Executing privileged containers creates severe container breakout and root compromise risks.
          You must update your manifest to set securityContext.privileged: false.
        pattern:
          spec:
            containers:
              - =(securityContext):
                  =(privileged): "false" # Match pattern: privileged MUST be false or absent!
EOF

cat << 'EOF' > scorecards/master-ops-scorecard.yaml
apiVersion: soundcheck.backstage.io/v1alpha1
kind: Scorecard
metadata:
  name: master-enterprise-quality-scorecard
  title: Master Enterprise Quality & AI Governance Scorecard
spec:
  # ==============================================================================
  # CHECKS: Objective, programmatic check definitions eliminating spreadsheet compliance!
  # ==============================================================================
  checks:
    # CHECK 1: Verify catalog-info.yaml defines explicit entity ownership!
    - id: has-owner
      name: Explicit Entity Ownership
      rule:
        type: catalog
        path: spec.owner
        operator: isNotEmpty
 
    # CHECK 2: Verify TechDocs annotations are correctly defined!
    - id: has-techdocs
      name: TechDocs Markdown Documentation
      rule:
        type: catalog
        path: metadata.annotations['backstage.io/techdocs-ref']
        operator: isNotEmpty
 
  # ==============================================================================
  # LEVELS: Gamified maturity ratings incentivizing proactive technical debt remediation!
  # ==============================================================================
  levels:
    - name: 🥇 GOLD
      description: Elite engineering craftsmanship. 100% compliant with master platform standards.
      requiredChecks:
        - has-owner
        - has-techdocs
    - name: 🥉 BRONZE
      description: Severe technical debt discovered. High production outage and orphan microservice risk.
      requiredChecks:
        - has-owner
EOF

# 1. Verify explicit ownership in the Backstage Component catalog manifest
cat catalog/vllm-catalog-info.yaml | grep -E "owner:.*group:ai-platform"
 
# 2. Verify catalog:register action step in the Backstage Software Template manifest
cat templates/vllm-scaffolder-template.yaml | grep -E "action:.*catalog:register"
 
# 3. Verify Matrix generator block in the ArgoCD ApplicationSet manifest
cat gitops/master-appset.yaml | grep -E "matrix:.*" -A 1
 
# 4. Verify selfHeal sync policy in the ArgoCD ApplicationSet manifest
cat gitops/master-appset.yaml | grep -E "selfHeal:.*true"
 
# 5. Verify Enforce validation failure action in the Kyverno ClusterPolicy manifest
cat governance/enterprise-cluster-policy.yaml | grep -E "validationFailureAction:.*Enforce"
 
# 6. Verify isNotEmpty rule operator in the Backstage Ops Scorecard manifest
cat scorecards/master-ops-scorecard.yaml | grep -E "operator:.*isNotEmpty" -m 1

  owner: group:ai-platform
      action: catalog:register
    - matrix:
        generators:
          selfHeal: true
  validationFailureAction: Enforce
        operator: isNotEmpty

# Safely remove the enterprise IDP lab directory
rm -rf ~/enterprise-idp-lab
 
# Verify the directory was removed successfully
ls -la ~/enterprise-idp-lab 2>/dev/null || echo "Cleanup complete. Directory successfully removed."