export const kubeconfig = pulumi.secret(
  pulumi
    .all([cluster.name, cluster.endpoint, cluster.masterAuth, config.project])
    .apply(([clusterName, clusterEndpoint, clusterAuth, project]) =>
      createKubeconfig({
        project,
        region,
        clusterCaCertificate: clusterAuth.clusterCaCertificate,
        clusterEndpoint: clusterEndpoint,
        clusterName: clusterName
      })
    )
);

const k8sProvider = new k8s.Provider(name, {
  kubeconfig
});

export function createKubeconfig(ctx: {
  project: string;
  region: string;
  clusterName: string;
  clusterEndpoint: string;
  clusterCaCertificate: string;
}) {
  const context = `${ctx.project}_${ctx.region}_${ctx.clusterName}`;

  return `apiVersion: v1
clusters:
- name: ${context}
  cluster:
    certificate-authority-data: ${ctx.clusterCaCertificate}
    server: https://${ctx.clusterEndpoint}
contexts:
- name: ${context}
  context:
    cluster: ${context}
    user: ${context}
current-context: ${context}
kind: Config
preferences: {}
users:
- name: ${context}
  user:
    auth-provider:
      name: gcp
      config:
        cmd-args: config config-helper --format=json
        cmd-path: gcloud
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
`;
}

createKubeconfig