#!/bin/bash
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

DORIS_ROOT=${DORIS_ROOT:-"/opt/apache-doris"}
# if config secret for basic auth about operate node of doris, the path must be `/etc/doris/basic_auth`. This is set by operator and the key of password must be `password`.
AUTH_PATH="/etc/basic_auth"
# annotations_for_recovery_start
ANNOTATION_PATH="/etc/podinfo/annotations"
RECOVERY_KEY=""
# fe location
DORIS_HOME=${DORIS_ROOT}/fe
# participant election number of fe.
ELECT_NUMBER=${ELECT_NUMBER:=3}
# query port for mysql connection.
QUERY_PORT=${FE_QUERY_PORT:-9030}
EDIT_LOG_PORT=9010
# location of fe config store.
FE_CONFFILE=$DORIS_HOME/conf/fe.conf
# represents the type for fe communication: domain or IP.
START_TYPE=
# the master node in fe cluster.
FE_MASTER=
# pod ordinal of statefulset deployed pod.
POD_INDEX=
# probe interval: 2 seconds
PROBE_INTERVAL=2
# timeout for fqdn ready check.
DNS_READY_TIMEOUT=${DNS_READY_TIMEOUT:-120}
# interval for fqdn ready check.
DNS_READY_INTERVAL=${DNS_READY_INTERVAL:-2}
# timeout for probe master: 60 seconds
PROBE_MASTER_POD0_TIMEOUT=60 # at most 30 attempts, no less than the times needed for an election
# no-0 ordinal pod timeout for probe master: 90 times
PROBE_MASTER_PODX_TIMEOUT=180 # at most 90 attempts
# administrator for administrate the cluster.
DB_ADMIN_USER=${USER:-"root"}

DB_ADMIN_PASSWD=$PASSWD
# myself as IP or FQDN
MYSELF=
# doris mtat storage path
DORIS_META_DIR=

#specify enable tls or not.
ENABLE_TLS=

#tls_certificate_path specify the path of public crt.
TLS_CERTIFICATE_PATH=

#tls_private_key_path specify the public secert key.
TLS_PRIVATE_KEY_PATH=

# tls_ca_certificate_path specify the root ca cert.
TLS_CA_CERTIFICATE_PATH=

function log_stderr()
{
  echo "[`date`] $@" >& 2
}

#parse the `$FE_CONFFILE` file, passing the key need resolve as parameter.
parse_confval_from_fe_conf()
{
    # a naive script to grep given confkey from fe conf file
    local confkey=$1

    esc_key=$(printf '%s\n' "$confkey" | sed 's/[[\.*^$()+?{|]/\\&/g')
    local confvalue=$(
        grep -v '^[[:space:]]*#' "$FE_CONFFILE" |
        grep -E "^[[:space:]]*${esc_key}[[:space:]]*=" |
        tail -n1 |
        sed -E 's/^[[:space:]]*[^=]+[[:space:]]*=[[:space:]]*//' |
        sed -E 's/[[:space:]]*#.*$//' |
        sed -E 's/^[[:space:]]+|[[:space:]]+$//g'
    )
    log_stderr "[info] read 'fe.conf' config [ $confkey: $confvalue]"
    echo "$confvalue"
}

# when image exist int doris-meta, use exist meta to start.
function start_fe_with_meta()
{
    log_stderr "start with meta run start_fe.sh"
    # the server will start in the current terminal session, and the log output and console interaction will be printed to that terminal
    # befor doris 2.0.2 ,doris start with : start_xx.sh
    # sine doris 2.0.2 ,doris start with : start_xx.sh --console  doc: https://doris.apache.org/docs/dev/install/standard-deployment/#version--202
    $DORIS_HOME/fe/bin/start_fe.sh --console
}

collect_env_info()
{
    # set POD_IP, POD_FQDN, POD_INDEX, EDIT_LOG_PORT, QUERY_PORT
    if [[ "x$POD_IP" == "x" ]] ; then
        POD_IP=`hostname -i | awk '{print $1}'`
    fi

    if [[ "x$POD_FQDN" == "x" ]] ; then
        POD_FQDN=`hostname -f`
    fi

    # example: fe-sr-deploy-1.fe-svc.kc-sr.svc.cluster.local
    POD_INDEX=`echo $POD_FQDN | awk -F'.' '{print $1}' | awk -F'-' '{print $NF}'`

    # since selectdb/doris.fe-ubuntu:2.0.2 , fqdn is forced to open without using ip method(enable_fqdn_mode = true).
    # Therefore START_TYPE is true
    START_TYPE=`parse_confval_from_fe_conf "enable_fqdn_mode"`

    if [[ "x$START_TYPE" == "xtrue" ]]; then
        MYSELF=$POD_FQDN
    else
        MYSELF=$POD_IP
    fi

    # edit_log_port from conf file
    local edit_log_port=`parse_confval_from_fe_conf "edit_log_port"`
    if [[ "x$edit_log_port" != "x" ]] ; then
        EDIT_LOG_PORT=$edit_log_port
    fi

    # query_port from conf file
    local query_port=`parse_confval_from_fe_conf "query_port"`
    if [[ "x$query_port" != "x" ]] ; then
        QUERY_PORT=$query_port
    fi

    # parse meta_dir
    local doris_meta_path=`parse_confval_from_fe_conf "meta_dir"`
    if [[ "x$doris_meta_path" == "x" ]] ; then
        doris_meta_path="/opt/apache-doris/fe/doris-meta"
    fi
    DORIS_META_DIR=$doris_meta_path
}

wait_for_fqdn_ready()
{
    if [[ "x$START_TYPE" != "xtrue" ]] ; then
        return 0
    fi

    local fqdn=$POD_FQDN
    local start=`date +%s`
    while true
    do
        if getent hosts "$fqdn" >/dev/null 2>&1 || nslookup "$fqdn" >/dev/null 2>&1 ; then
            log_stderr "[info] fqdn $fqdn is ready."
            return 0
        fi

        local now=`date +%s`
        let "expire=start+DNS_READY_TIMEOUT"
        if [[ $expire -le $now ]] ; then
            log_stderr "[error] timeout waiting fqdn ready: $fqdn"
            return 1
        fi

        log_stderr "[info] fqdn $fqdn not ready, sleep ${DNS_READY_INTERVAL}s ..."
        sleep $DNS_READY_INTERVAL
    done
}

# get all registered fe in cluster.
show_frontends()
{
    if [[ "$ENABLE_TLS" == "true" ]]; then
        show_frontends_with_tls $1
    else
        show_frontends_with_no_tls $1
    fi
}

function show_frontends_with_no_tls()
{
    local addr=$1
    # fist start use root and no password check. avoid use pre setted username and password.
    frontends=`timeout 15 mysql --connect-timeout 2 -h $addr -P $QUERY_PORT -uroot --batch -e 'show frontends;' 2>&1`
    log_stderr "[info] [NO-TLS] show frontends result '$frontends'"
    if echo $frontends | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configured show frontends."
        frontends=`timeout 15 mysql --connect-timeout 2 -h $addr -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --batch -e 'show frontends;' 2>&1`
    fi
   echo "$frontends"
}

show_frontends_with_tls()
{
    local addr=$1
    frontends=`timeout 15 mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $addr -P $QUERY_PORT -uroot --batch -e 'show frontends;' 2>&1`
    log_stderr "[info] [TLS] show frontends result '$frontends'"
    if echo $frontends | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configured show frontends."
        frontends=`timeout 15 mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $addr -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --batch -e 'show frontends;' 2>&1`
    fi
   echo "$frontends"
}

# add myself in cluster for FOLLOWER.
add_self_follower()
{
    if [[ "$ENABLE_TLS" == "true" ]]; then
        add_self_follower_with_tls
    else
        add_self_follower_with_no_tls
    fi
}

add_self_follower_with_no_tls()
{
    add_result=`mysql --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -uroot --skip-column-names --batch -e "ALTER SYSTEM ADD FOLLOWER \"$MYSELF:$EDIT_LOG_PORT\";" 2>&1`
    log_stderr "[info] [NO-TLS] add follower result '$add_result'"
    if echo $add_result | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configured to add self as follower."
        mysql --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --skip-column-names --batch -e "ALTER SYSTEM ADD FOLLOWER \"$MYSELF:$EDIT_LOG_PORT\";"
    fi
}

add_self_follower_with_tls()
{
    add_result=`mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -uroot --skip-column-names --batch -e "ALTER SYSTEM ADD FOLLOWER \"$MYSELF:$EDIT_LOG_PORT\";" 2>&1`
    log_stderr "[info] [TLS] add follower result '$add_result'"
    if echo $add_result | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configured to add self as follower."
        mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --skip-column-names --batch -e "ALTER SYSTEM ADD FOLLOWER \"$MYSELF:$EDIT_LOG_PORT\";"
    fi
}

# add myself in cluster for OBSERVER.
add_self_observer()
{
    if [[ "$ENABLE_TLS" == "true" ]]; then
        add_self_observer_with_tls
    else
        add_self_observer_with_no_tls
    fi
}

add_self_observer_with_no_tls()
{
    add_result=`mysql --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -uroot --skip-column-names --batch -e "ALTER SYSTEM ADD OBSERVER \"$MYSELF:$EDIT_LOG_PORT\";" 2>&1`
    log_stderr "[info] [NO-TLS] add observer result '$add_result'."
    if echo $add_result | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configed to add self as observer."
        mysql --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --skip-column-names --batch -e "ALTER SYSTEM ADD OBSERVER \"$MYSELF:$EDIT_LOG_PORT\";"
    fi
}

add_self_observer_with_tls()
{
    add_result=`mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -uroot --skip-column-names --batch -e "ALTER SYSTEM ADD OBSERVER \"$MYSELF:$EDIT_LOG_PORT\";" 2>&1`
    log_stderr "[info] [TLS] add observer result '$add_result'."
    if echo $add_result | grep -w "1045" | grep -q -w "28000" &>/dev/null ; then
        log_stderr "[info] use username and password that configed to add self as observer."
        mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P $QUERY_PORT -u$DB_ADMIN_USER -p$DB_ADMIN_PASSWD --skip-column-names --batch -e "ALTER SYSTEM ADD OBSERVER \"$MYSELF:$EDIT_LOG_PORT\";"
    fi
}

# `dori-meta/image` not exist start as first time.
function start_fe_no_meta()
{
    # the server will start in the current terminal session, and the log output and console interaction will be printed to that terminal
    # befor doris 2.0.2 ,doris start with : start_xx.sh
    # sine doris 2.0.2 ,doris start with : start_xx.sh --console  doc: https://doris.apache.org/docs/dev/install/standard-deployment/#version--202
    local opts="--console"
    local start=`date +%s`
    local has_member=false
    local member_list=
    if [[ "x$FE_MASTER" != "x" ]] ; then
        opts+=" --helper $FE_MASTER:$EDIT_LOG_PORT"
        local start=`date +%s`
        while true
        do
            # for statefulset manage fe pods, when `ELECT_NUMBER` greater than `POD_INDEX`
            if [[ ELECT_NUMBER -gt $POD_INDEX ]]; then
                log_stderr "Add myself($MYSELF:$EDIT_LOG_PORT) to master as follower ..."
                add_self_follower
            else
                log_stderr "Add myself($MYSELF:$EDIT_LOG_PORT) to master as observer ..."
                add_self_observer
            fi
               # if successfully exit circulate register logic and start fe.
            if show_frontends $addr | grep -q -w "$MYSELF" &>/dev/null ; then
                break;
            fi

            local now=`date +%s`
            let "expire=start+30" # 30s timeout
            # if timeout for register self exit 1.
            if [[ $expire -le $now ]] ; then
                log_stderr "Timed out, abort!"
                exit 1
            fi

            log_stderr "Sleep a while and retry adding ..."
            sleep $PROBE_INTERVAL
        done
    fi
    log_stderr "first start with no meta run start_fe.sh with additional options: '$opts'"
    $DORIS_HOME/bin/start_fe.sh $opts
}

# the ordinal is 0, probe timeout as 60s, when have not meta and not `MASTER` in fe cluster, 0 start as master.
probe_master_for_pod()
{
    # possible to have no result at all, because myself is the first FE instance in the cluster
    local svc=$1
    local start=`date +%s`
    local has_member=false
    local memlist=
    while true
    do
        memlist=`show_frontends $svc`
        # find master by column `IsMaster`
        local pos=`echo "$memlist" | grep '\<IsMaster\>' | awk -F '\t' '{for(i=1;i<NF;i++) {if ($i == "IsMaster") print i}}'`
        local master=`echo "$memlist" | grep '\<FOLLOWER\>' | awk -v p="$pos" -F '\t' '{if ($p=="true") print $2}'`

        log_stderr "'IsMaster' sequence in columns is $pos, master=$master."
        if [[ "x$master" == "x" ]]; then
            log_stderr "[info] resolve the eighth column for finding master !"
            master=`echo "$memlist" | grep '\<FOLLOWER\>' | awk -F '\t' '{if ($8=="true") print $2}'`
        fi

        if [[ "x$master" == "x" ]]; then
           # compatible 2.1.0
           log_stderr "[info] resoluve the ninth column for finding master!"
           master=`echo "$memlist" | grep '\<FOLLOWER\>' | awk -F '\t' '{if ($9=="true") print $2}'`
        fi

        if [[ "x$master" != "x" ]] ; then
            # has master, done
            log_stderr "Find master: $master!"
            FE_MASTER=$master
            return 0
        fi

        # show frontens has members
        if [[ "x$memlist" != "x" && "x$pos" != "x" ]] ; then
            # has member list ever before
            has_member=true
        fi

        # no master yet, check if needs timeout and quit
        log_stderr "[info] master is not elected, has_member: $has_member, this may be first start or master changing, wait $PROBE_INTERVAL s to next probe..."
        local timeout=$PROBE_MASTER_POD0_TIMEOUT
        if  "$has_member" == true || [ "$POD_INDEX" -ne "0" ] ; then
            # set timeout to the same as PODX since there are other members
            timeout=$PROBE_MASTER_PODX_TIMEOUT
        fi

        local now=`date +%s`
        let "expire=start+timeout"
        if [[ $expire -le $now ]] ; then
            log_stderr "[info]  exit probe master for probing timeout, if it is the first pod will start as master. .."
            # empty FE_MASTER
            FE_MASTER=""
            return 0
        fi
        sleep $PROBE_INTERVAL
    done
}

# when not meta exist, fe start should probe
probe_master()
{
    local svc=$1
    # resolve svc as array.
    local addArr=${svc//,/ }
    for addr in ${addArr[@]}
    do
        # if have master break for register or check.
        if [[ "x$FE_MASTER" != "x" ]]; then
            break
        fi

        # find master under current service and set to FE_MASTER
        probe_master_for_pod $addr
    done

    # if first pod assume first start should as master. others first start have not master exit.
    if [[ "x$FE_MASTER" == "x" ]]; then
        if [[ "$POD_INDEX" -eq 0 ]]; then
            return 0
        else
            log_stderr "the pod can't connect to pod 0, the network may be not work. please verify domain connectivity with two pods in different node and verify the pod 0 ready or not."
            exit 1
        fi
    fi
}

function add_fqdn_config()
{
    echo "" >>${DORIS_HOME}/conf/fe.conf
    # TODO(user):since selectdb/doris.fe-ubuntu:2.0.2 , `enable_fqdn_mode` is forced to set `true` for starting doris. (enable_fqdn_mode = true).
    local enable_fqdn=`parse_confval_from_fe_conf "enable_fqdn_mode"`
    log_stderr "enable_fqdn is : $enable_fqdn"
    if [[ "x$enable_fqdn" != "xtrue" ]] ; then
        log_stderr "add enable_fqdn_mode = true to ${DORIS_HOME}/conf/fe.conf"
        echo "enable_fqdn_mode = true" >>${DORIS_HOME}/conf/fe.conf
    fi
}

update_conf_from_configmap()
{
    if [[ "x$CONFIGMAP_MOUNT_PATH" == "x" ]] ; then
        log_stderr '[info] Empty $CONFIGMAP_MOUNT_PATH env var, skip it!'
        add_fqdn_config
        return 0
    fi
    if ! test -d $CONFIGMAP_MOUNT_PATH ; then
        log_stderr "[info] $CONFIGMAP_MOUNT_PATH not exist or not a directory, ignore ..."
        add_fqdn_config
        return 0
    fi
    local tgtconfdir=$DORIS_HOME/conf
    for conffile in `ls $CONFIGMAP_MOUNT_PATH`
    do
        log_stderr "[info] Process conf file $conffile ..."
        local tgt=$tgtconfdir/$conffile
        if test -e $tgt ; then
            # make a backup
            mv -f $tgt ${tgt}.bak
        fi
        ln -sfT $CONFIGMAP_MOUNT_PATH/$conffile $tgt
    done
    add_fqdn_config
}

mount_kerberos_config()
{
    if [[ ! -n "$KRB5_MOUNT_PATH" ]]; then
        return
    fi

    KRB5_CONFIG_DIR=$(dirname "$KRB5_CONFIG")
    # If the krb5 directory does not exist, need to create it.
    if [[ ! -d "$KRB5_CONFIG_DIR" ]]; then
        log_stderr "[info] Creating krb5 directory: $KRB5_CONFIG_DIR"
        mkdir -p "$KRB5_CONFIG_DIR"
    fi

    log_stderr "[info] Creating krb5 symlinks for each file from $KRB5_MOUNT_PATH to $KRB5_CONFIG_DIR"
    # The files under KRB5_MONT_PATH are soft links from other directories. Therefore, a for loop is needed to directly soft link the files.
    for file in "$KRB5_MOUNT_PATH"/*; do
        if [ -e "$file" ]; then
            filename=$(basename "$file")
            log_stderr "[info] Creating krb5 symlink for $filename"
            ln -sf "$file" "$KRB5_CONFIG_DIR/$filename"
        fi
    done

    if [[ "$KEYTAB_MOUNT_PATH" == "$KEYTAB_FINAL_USED_PATH" ]]; then
        log_stderr "[info] KEYTAB_MOUNT_PATH is same as KEYTAB_FINAL_USED_PATH, skip creating symlinks"
        return
    fi

    # If the keytab directory does not exist, need to create it.
    if [[ ! -d "$KEYTAB_FINAL_USED_PATH" ]]; then
        log_stderr "[info] Creating keytab directory: $KEYTAB_FINAL_USED_PATH"
        mkdir -p "$KEYTAB_FINAL_USED_PATH"
    fi

    log_stderr "[info] Creating keytab symlinks for each file from $KEYTAB_MOUNT_PATH to $KEYTAB_FINAL_USED_PATH"
    # The files under KEYTAB_MOUNT_PATH are soft links from other directories. Therefore, a for loop is needed to directly soft link the files.
    for file in "$KEYTAB_MOUNT_PATH"/*; do
        if [ -e "$file" ]; then
            filename=$(basename "$file")
            log_stderr "[info] Creating keytab symlink for $filename"
            ln -sf "$file" "$KEYTAB_FINAL_USED_PATH/$filename"
        fi
    done
}

# resolve password for root
resolve_password_from_secret()
{
    if [[ -f "$AUTH_PATH/password" ]]; then
        DB_ADMIN_PASSWD=`cat $AUTH_PATH/password`
    fi

    if [[ -f "$AUTH_PATH/username" ]]; then
        DB_ADMIN_USER=`cat $AUTH_PATH/username`
    fi
}

start_fe_with_meta()
{
    # the server will start in the current terminal session, and the log output and console interaction will be printed to that terminal
    # befor doris 2.0.2 ,doris start with : start_xx.sh
    local opts="--console"
    local recovery=`grep "\<selectdb.com.doris/recovery\>" $ANNOTATION_PATH | grep -v '^\s*#' | sed 's|^\s*'$confkey'\s*=\s*\(.*\)\s*$|\1|g'`
    if [[ "x$recovery" != "x" ]]; then
        opts=${opts}" --metadata_failure_recovery"
    fi

    log_stderr "start with meta run start_fe.sh with additional options: '$opts'"
     # sine doris 2.0.2 ,doris start with : start_xx.sh --console  doc: https://doris.apache.org/docs/dev/install/standard-deployment/#version--202
    $DORIS_HOME/bin/start_fe.sh  $opts
}

# print the least 10 records of 'VLSN'. When fe failed to restart, user can select the fe of VLSN is the bigest to force restart.
print_vlsn()
{
    local doris_meta_path=`parse_confval_from_fe_conf "meta_dir"`
    if [[ "x$doris_meta_path" == "x" ]] ; then
        doris_meta_path="/opt/apache-doris/fe/doris-meta"
    fi

    vlsns=`grep -rn "VLSN:" $doris_meta_path/bdb/je* | tail -n 10`
    echo "$vlsns"
}

parse_tls_connection_variables()
{
   ENABLE_TLS=`parse_confval_from_fe_conf "enable_tls"`
   TLS_CERTIFICATE_PATH=`parse_confval_from_fe_conf "tls_certificate_path"`
   TLS_PRIVATE_KEY_PATH=`parse_confval_from_fe_conf "tls_private_key_path"`
   TLS_CA_CERTIFICATE_PATH=`parse_confval_from_fe_conf "tls_ca_certificate_path"`
   if [[ "$ENABLE_TLS" == "true" ]]; then
       log_stderr "[info] [TLS] TLS is ENABLED, ca=$TLS_CA_CERTIFICATE_PATH, cert=$TLS_CERTIFICATE_PATH, key=$TLS_PRIVATE_KEY_PATH"
   else
       log_stderr "[info] [NO-TLS] TLS is DISABLED (enable_tls='$ENABLE_TLS')"
   fi
}

#fist start create account and grant 'NODE_PRIV'
create_account()
{
    if [[ "$ENABLE_TLS" == "true" ]]; then
        create_account_with_tls
    else
        create_account_with_no_tls
    fi
}

create_account_with_no_tls()
{
    if [[ "x$FE_MASTER" == "x" ]]; then
		return 0
	fi

    # if not set password, the account not config.
    if [[ "x$DB_ADMIN_PASSWD" == "x" ]]; then
        return 0
    fi

    users=`timeout 15 mysql --connect-timeout 2 -h $FE_MASTER -P$QUERY_PORT -uroot --skip-column-names --batch -e 'SHOW ALL GRANTS;' 2>&1`
    if echo $users | grep -w "1045" | grep -q -w "28000" &>/dev/null; then
        log_stderr "the 'root' account have set paasword! not need auto create management account."
        return 0
    fi

    if echo $users | awk '{print $1}' | grep -q -w "$DB_ADMIN_USER" &>/dev/null; then
       log_stderr "the $DB_ADMIN_USER have exist in doris."
       return 0
    fi

    `mysql --connect-timeout 2 -h $FE_MASTER -P$QUERY_PORT -uroot --skip-column-names --batch -e "CREATE USER '$DB_ADMIN_USER' IDENTIFIED BY '$DB_ADMIN_PASSWD';GRANT NODE_PRIV ON *.*.* TO $DB_ADMIN_USER;" 2>&1`
    log_stderr "[NO-TLS] created new account and grant NODE_PRIV!"
}

create_account_with_tls()
{
    if [[ "x$FE_MASTER" == "x" ]]; then
		return 0
	fi

    # if not set password, the account not config.
    if [[ "x$DB_ADMIN_PASSWD" == "x" ]]; then
        return 0
    fi

    users=`timeout 15 mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P$QUERY_PORT -uroot --skip-column-names --batch -e 'SHOW ALL GRANTS;' 2>&1`
    if echo $users | grep -w "1045" | grep -q -w "28000" &>/dev/null; then
        log_stderr "the 'root' account have set paasword! not need auto create management account."
        return 0
    fi

    if echo $users | awk '{print $1}' | grep -q -w "$DB_ADMIN_USER" &>/dev/null; then
       log_stderr "the $DB_ADMIN_USER have exist in doris."
       return 0
    fi

    `mysql --ssl-mode=VERIFY_CA --tls-version="TLSv1.2" --ssl-ca=$TLS_CA_CERTIFICATE_PATH --ssl-cert=$TLS_CERTIFICATE_PATH --ssl-key=$TLS_PRIVATE_KEY_PATH --connect-timeout 2 -h $FE_MASTER -P$QUERY_PORT -uroot --skip-column-names --batch -e "CREATE USER '$DB_ADMIN_USER' IDENTIFIED BY '$DB_ADMIN_PASSWD';GRANT NODE_PRIV ON *.*.* TO $DB_ADMIN_USER;" 2>&1`
    log_stderr "[TLS] created new account and grant NODE_PRIV!"
}

fe_addrs=$1
if [[ "x$fe_addrs" == "x" ]]; then
    echo "need fe address as parameter!"
    exit
fi

#first upate config
update_conf_from_configmap
collect_env_info
wait_for_fqdn_ready || exit 1
mount_kerberos_config
# resolve password for root to manage nodes in doris.
resolve_password_from_secret
#parse tls connection config
parse_tls_connection_variables
# if [[ -f "/opt/apache-doris/fe/doris-meta/image/ROLE" ]]; then
doris_meta_dir=$(eval "echo \"$DORIS_META_DIR\"")
if [[ -f "$doris_meta_dir/image/ROLE" ]]; then
    log_stderr "start fe with exist meta."
    ./doris-debug --component fe
    print_vlsn
    start_fe_with_meta
else
    log_stderr "first start fe with meta not exist."
    probe_master $fe_addrs
    #create account about node management
    create_account
    start_fe_no_meta
fi