#!/usr/bin/env bash
# nerf-kubectl-get -- Get kubernetes resources. Returns JSON; pipe through jq for extraction. Refuses Secrets -- use kubectl-get-secrets instead, which redacts .data and .stringData.
# Generated from kubectl manifest. Do not edit directly.
# nerf:threat:read=remote
# nerf:threat:write=none

if [[ "${BASH_VERSINFO[0]:-0}" -lt 4 ]]; then
  echo "error: nerf-kubectl-get requires bash 4+. Found bash ${BASH_VERSION:-unknown}" >&2
  echo "  hint: on macOS, install a newer bash via 'brew install bash'" >&2
  exit 1
fi

set -euo pipefail

_NERF_DRY_RUN=""

usage() {
  cat >&2 <<'EOF'
Usage: nerf-kubectl-get [--all-namespaces|-A] [--show-labels] [--namespace|-n <namespace>] [--selector|-l <selector>] [--field-selector <field_selector>] <resource> [<name>]

Switches:
  --all-namespaces, -A
      List across all namespaces
  --show-labels
      Include labels in the output

Options:
  --namespace, -n <namespace>
      Namespace
      Must match: ^[a-z0-9-]+$
  --selector, -l <selector>
      Label selector (e.g. app=foo,env!=prod)
  --field-selector <field_selector>
      Field selector (e.g. status.phase=Running)

Arguments:
  <resource> (required)
      Resource type (e.g. pods, services, deployments) or "kind/name"
      Must match: ^[a-z][a-zA-Z0-9.-]*(/[a-zA-Z0-9._-]+)?$
  <name>
      Specific resource name (optional)
      Must match: ^[a-zA-Z0-9._-]+$

Maps to: kubectl get <resource> <name> <namespace> <all_namespaces> <selector> <field_selector> <show_labels> --output json

Get kubernetes resources. Returns JSON; pipe through jq for extraction. Refuses Secrets -- use kubectl-get-secrets instead, which redacts .data and .stringData.
EOF
  exit 1
}

ALL_NAMESPACES=""
SHOW_LABELS=""
NAMESPACE=""
_NAMESPACE_SET=""
SELECTOR=""
_SELECTOR_SET=""
FIELD_SELECTOR=""
_FIELD_SELECTOR_SET=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --all-namespaces|-A) if [[ -n "${ALL_NAMESPACES}" ]]; then echo "error: --all-namespaces can only be specified once" >&2; exit 1; fi; ALL_NAMESPACES="true"; shift 1 ;;
    --show-labels) if [[ -n "${SHOW_LABELS}" ]]; then echo "error: --show-labels can only be specified once" >&2; exit 1; fi; SHOW_LABELS="true"; shift 1 ;;
    --namespace|-n) if [[ -n "${_NAMESPACE_SET}" ]]; then echo "error: --namespace can only be specified once" >&2; exit 1; fi; NAMESPACE="$2"; _NAMESPACE_SET=true; shift 2 ;;
    --selector|-l) if [[ -n "${_SELECTOR_SET}" ]]; then echo "error: --selector can only be specified once" >&2; exit 1; fi; SELECTOR="$2"; _SELECTOR_SET=true; shift 2 ;;
    --field-selector) if [[ -n "${_FIELD_SELECTOR_SET}" ]]; then echo "error: --field-selector can only be specified once" >&2; exit 1; fi; FIELD_SELECTOR="$2"; _FIELD_SELECTOR_SET=true; shift 2 ;;
    --nerf-dry-run) _NERF_DRY_RUN="true"; shift 1 ;;
    -h|--help) usage ;;
    --) shift; break ;;
    *) break ;;
  esac
done

_RESOURCE_SET=""
if [[ $# -gt 0 ]]; then
  RESOURCE="$1"
  _RESOURCE_SET=true
  shift
else
  RESOURCE=""
fi
_NAME_SET=""
if [[ $# -gt 0 ]]; then
  NAME="$1"
  _NAME_SET=true
  shift
else
  NAME=""
fi
if [[ $# -gt 0 ]]; then
  echo "error: nerf-kubectl-get: unexpected extra arguments: $*" >&2
  echo "  hint: switches and options must come before positional arguments" >&2
  exit 1
fi

_NERF_PATTERN='^[a-z0-9-]+$'
if [[ -n "${_NAMESPACE_SET}" ]] && ! [[ "${NAMESPACE}" =~ $_NERF_PATTERN ]]; then
  echo "error: nerf-kubectl-get: option --namespace does not match required pattern" >&2
  echo "  value:   \"${NAMESPACE}\"" >&2
  echo "  pattern: ^[a-z0-9-]+$" >&2
  echo "  hint: value must match ^[a-z0-9-]+$" >&2
  exit 1
fi

if [[ -n "${_RESOURCE_SET}" ]] && [[ "${RESOURCE}" == -* ]]; then
  echo "error: nerf-kubectl-get: <resource> cannot start with '-'" >&2
  echo "  hint: use -- before positional arguments if needed" >&2
  exit 1
fi

if [[ -z "${RESOURCE}" ]]; then
  echo "error: nerf-kubectl-get: missing required argument <resource>" >&2
  echo "  hint: provide a value for <resource>" >&2
  usage
fi

_NERF_PATTERN='^[a-z][a-zA-Z0-9.-]*(/[a-zA-Z0-9._-]+)?$'
if [[ -n "${_RESOURCE_SET}" ]] && ! [[ "${RESOURCE}" =~ $_NERF_PATTERN ]]; then
  echo "error: nerf-kubectl-get: argument <resource> does not match required pattern" >&2
  echo "  value:   \"${RESOURCE}\"" >&2
  echo "  pattern: ^[a-z][a-zA-Z0-9.-]*(/[a-zA-Z0-9._-]+)?$" >&2
  echo "  hint: value must match ^[a-z][a-zA-Z0-9.-]*(/[a-zA-Z0-9._-]+)?$" >&2
  exit 1
fi

if [[ -n "${_NAME_SET}" ]] && [[ "${NAME}" == -* ]]; then
  echo "error: nerf-kubectl-get: <name> cannot start with '-'" >&2
  echo "  hint: use -- before positional arguments if needed" >&2
  exit 1
fi

_NERF_PATTERN='^[a-zA-Z0-9._-]+$'
if [[ -n "${_NAME_SET}" ]] && ! [[ "${NAME}" =~ $_NERF_PATTERN ]]; then
  echo "error: nerf-kubectl-get: argument <name> does not match required pattern" >&2
  echo "  value:   \"${NAME}\"" >&2
  echo "  pattern: ^[a-zA-Z0-9._-]+$" >&2
  echo "  hint: value must match ^[a-zA-Z0-9._-]+$" >&2
  exit 1
fi

( [[ ! "$(echo "${RESOURCE}" | tr '[:upper:]' '[:lower:]')" =~ ^secrets?($|\.|/) ]] ) || { echo 'error: nerf-kubectl-get: kubectl-get refuses secrets. Use kubectl-get-secrets which redacts .data / .stringData.' >&2; exit 1; }

if [[ "$_NERF_DRY_RUN" == "true" ]]; then
  _NERF_DRY_CMD=(kubectl get "${RESOURCE}" ${_NAME_SET:+"$NAME"} ${_NAMESPACE_SET:+"--namespace"} ${_NAMESPACE_SET:+"$NAMESPACE"} ${ALL_NAMESPACES:+"--all-namespaces"} ${_SELECTOR_SET:+"--selector"} ${_SELECTOR_SET:+"$SELECTOR"} ${_FIELD_SELECTOR_SET:+"--field-selector"} ${_FIELD_SELECTOR_SET:+"$FIELD_SELECTOR"} ${SHOW_LABELS:+"--show-labels"} --output json)
  printf 'dry-run:'
  for _a in "${_NERF_DRY_CMD[@]}"; do printf " %q" "$_a"; done
  echo
  exit 0
fi

exec kubectl get "${RESOURCE}" ${_NAME_SET:+"$NAME"} ${_NAMESPACE_SET:+"--namespace"} ${_NAMESPACE_SET:+"$NAMESPACE"} ${ALL_NAMESPACES:+"--all-namespaces"} ${_SELECTOR_SET:+"--selector"} ${_SELECTOR_SET:+"$SELECTOR"} ${_FIELD_SELECTOR_SET:+"--field-selector"} ${_FIELD_SELECTOR_SET:+"$FIELD_SELECTOR"} ${SHOW_LABELS:+"--show-labels"} --output json
