cat <<EOF | kind create cluster --name ikoseed --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
  - role: worker
  - role: worker
  - role: worker
  - role: worker
networking:
  disableDefaultCNI: true
EOF
kind get kubeconfig --name ikoseed > ikoseed.kubeconfig
cilium install --version v1.18.0 --kubeconfig ikoseed.kubeconfig
cilium status --wait --kubeconfig ikoseed.kubeconfig
helm install iko iris-operator/ --kubeconfig ikoseed.kubeconfig

planets=(tatooine coruscant hoth naboo endor)
i=0
for node in $(kubectl get nodes --no-headers --kubeconfig ikoseed.kubeconfig | awk '/worker/{print $1}'); do
  planet=${planets[$i]}
  kubectl label node "$node" topology.kubernetes.io/zone="$planet" --overwrite --kubeconfig ikoseed.kubeconfig
  echo "$node → zone=$planet"
  i=$(( (i+1) % ${#planets[@]} ))
done

kubectl get nodes -L topology.kubernetes.io/zone --kubeconfig ikoseed.kubeconfig

# full IKO documentation:
# https://docs.intersystems.com/irislatest/csp/docbook/Doc.View.cls?KEY=PAGE_deployment_iko
apiVersion: intersystems.com/v1alpha1
kind: IrisCluster
metadata:
  name: ikoplus-seed-sweenx12
  namespace: ikoplus
spec:
  imagePullSecrets:
    - name: containers-pull-secret
  licenseKeySecret:
    name: license-key-secret
  tls:
    webgateway:
      secret:
        secretName: cert-secret
  volumes:
    - name: foo
      emptyDir: {}
    - name: airgapdir
      emptyDir: {}
    - name: seed-before-volume
      configMap:
        name: seed-before-script
    - name: seed-after-volume
      configMap:
        name: seed-after-script
  topology:
    data:
      updateStrategy: {}
      image: containers.intersystems.com/intersystems/irishealth:2025.1
      mirrorMap: primary,backup,drasync,rwrasync
      mirrored: true
      volumeMounts:
        - name: airgapdir
          mountPath: /airgapdir
        - name: foo
          mountPath: "/irissys/foo/"
        - name: seed-before-volume
          mountPath: /hs/before/
        - name: seed-after-volume
          mountPath: /hs/after/
      irisDatabases:
        - name: SAMPLES
          directory: /irissys/data/IRIS/mgr/SAMPLES
          mirrored: true
          ecp: true
          seed: /airgapdir/
          logicalOnly: false
      irisNamespaces:
        - name: ENSDEMO
          routines: SAMPLES
          globals: SAMPLES
          interop: true
      podTemplate:
        spec:
          args:
            - --before
            - /usr/bin/bash /hs/before/before.sh
            - --after
            - /usr/bin/bash /hs/after/after.sh
          securityContext:
            fsGroup: 51773
            runAsGroup: 51773
            runAsNonRoot: true
            runAsUser: 51773
          initContainers:
            - name: init-grongierisc-samples
              image: debian:bookworm-slim
              command:
                - sh
                - -c
                - |
                  echo "Installing getting Samples from @grongierisc's repository https://github.com/grongierisc/InstallSamples/tree/master ..."
                  #set -euo pipefail
                  apt-get update
                  DEBIAN_FRONTEND=noninteractive apt-get install -y curl
                  cd /airgapdir
                  curl -L https://media.githubusercontent.com/media/grongierisc/InstallSamples/refs/heads/master/samples/IRIS.DAT --output IRIS.DAT
                  #curl -L http://192.168.1.231:8080/IRIS.DAT --output IRIS.DAT
                  chmod -R 777 /airgapdir
                  chown -R 51773:51773 /airgapdir
              volumeMounts:
                - name: airgapdir
                  mountPath: /airgapdir
              securityContext:
                runAsUser: 0 # run as rootabega
                runAsNonRoot: false
                readOnlyRootFilesystem: false
      preferredZones:
        - tatooine
        - coruscant
        - hoth
        - naboo
      webgateway:
        replicas: 1
        updateStrategy: {}
        alternativeServers: LoadBalancing
        applicationPaths:
          - /csp/sys
          - /csp/user
          - /csp/broker
          - /csp/hssys
          - /api
          - /api/healthshare-rest/hssys/register
          - /csp/healthshare/hssys/services
          - /isc
          - /oauth2
          - /ui
          - /csp/healthshare
          - /csp/bin
          - /*
        ephemeral: true
        image: containers.intersystems.com/intersystems/webgateway-lockeddown:2025.1
        loginSecret:
          name: webgateway-secret
        type: apache-lockeddown
    arbiter:
      image: containers.intersystems.com/intersystems/arbiter:2025.1
      updateStrategy: {}
    compute:
      image: containers.intersystems.com/intersystems/irishealth:2025.1
      ephemeral: true
      replicas: 1
      preferredZones:
        - endor
  serviceTemplate:
    spec:
      type: LoadBalancer
      externalTrafficPolicy: Local
---
apiVersion: v1
data:
  iris.key: REDACTED
kind: Secret
metadata:
  name: license-key-secret
  namespace: ikoplus
---
apiVersion: v1
data:
  password: U1lT
  username: Q1NQU3lzdGVt
kind: Secret
metadata:
  name: webgateway-secret
  namespace: ikoplus
---
apiVersion: v1
data:
  .dockerconfigjson: REDACTED
kind: Secret
metadata:
  name: containers-pull-secret
  namespace: ikoplus
type: kubernetes.io/dockerconfigjson
---
apiVersion: v1
data:
  ca.pem: REDACTED
  tls.crt: REDACTED
  tls.key: REDACTED
kind: Secret
metadata:
  creationTimestamp: null
  name: cert-secret
  namespace: ikoplus
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: seed-before-script
  namespace: ikoplus
data:
  before.sh: |-
    #! /usr/bin/bash
    # IRIS Not Available Here
    echo "Seed Before Script"
    #chown -R irisowner:irisowner /airgapdir
    #sleep 60
    #python3 -m pip install --upgrade --target /irissys/data/IRIS/mgr/python reportlab
    #mkdir /irissys/data/IRIS/mgr/SAMPLES
---
apiVersion: v1
data:
  password: U1lT
  username: REDACTED
kind: Secret
metadata:
  name: webgateway-secret
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: seed-after-script
  namespace: ikoplus
data:
  after.sh: |-
    #! /usr/bin/bash
    if ! [ -f "/irissys/data/after.done" ]; then
      echo "HS After Script executed..."
      iris session IRIS <<-'EOF'
        zn "%SYS"
        set tSC=##Class(Security.Users).Create("intersystems","%All","intersystems","USER","","","",0,1,,,,,,1,1)
        do ##class(Security.Users).Get("HS_Services", .user)
        set user("Enabled")=1
        set user("Password")="HS_Services"
        set status = ##class(Security.Users).Modify("HS_Services", .user)
        write $System.Status.GetErrorText(status)
        zn "HSSYS"
        Set oCredential = ##class(Ens.Config.Credentials).%OpenId("HS_Services")
        Set oCredential.Password = "HS_Services"
        Set tSC = oCredential.%Save()
        do ##class(HS.Util.Mirror.Task).Schedule("HSSYS")
        HANG 30
        zn "%SYS"
        if $SYSTEM.Mirror.IsPrimary() { Set tSC = ##class(SYS.Mirror).AddDatabase("/irissys/data/IRIS/mgr/SAMPLES/","IRISMIRROR1",) }
        if '($SYSTEM.Mirror.IsPrimary()) { Set tSC = ##class(SYS.Mirror).ActivateMirroredDatabase("/irissys/data/IRIS/mgr/SAMPLES/") }
        Set SFNlist = $lb(9)
        if '($SYSTEM.Mirror.IsPrimary()) { Set sc = ##class(SYS.Mirror).CatchupDB(SFNlist) )
        Halt
    EOF
      touch "/irissys/data/after.done"
    fi
    #python3 -m pip install --upgrade --target /irissys/data/IRIS/mgr/python reportlab
    exit

#!/bin/bash
# Run an IRIS ObjectScript command in all pods in the current namespace
# Example: zw ^MayTheForce
export KUBECONFIG=ikoseed.kubeconfig
NAMESPACE=${1:-default}
CMD='iris session IRIS -U ENSDEMO -B <<'EOF'
      ZWRITE ^MayTheForce
      HALT
EOF'
echo "Running '$CMD' in all pods in namespace '$NAMESPACE'..."
for pod in $(kubectl get pods -n "$NAMESPACE" -o jsonpath='{.items[*].metadata.name}'); do
  # echo "---- Pod: $pod ----"
  kubectl -n "$NAMESPACE" --kubeconfig ikoseed.kubeconfig exec "$pod" -- /bin/sh -c "$CMD" || echo "⚠️  Failed on $pod"
  echo
done