#!/bin/bash
set -e

export SOPS_AGE_KEY_FILE=/sops-age/keys.txt

# Decrypt grafana secrets once
GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)

# Stage 0: grafana
OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')

cat <<EOF
---
apiVersion: v1
kind: Secret
metadata:
  name: grafana-oidc
  namespace: logging
type: Opaque
data:
  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
---
apiVersion: v1
kind: Secret
metadata:
  name: grafana-admin
  namespace: logging
type: Opaque
data:
  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
EOF