#!/usr/bin/env bash

# note: tested with .sops.yaml
# creation_rules:
#   # default rule
#   - age: "age..."
#     unencrypted_regex: "^(apiVersion|metadata|kind|type)$"

DEMO=$(mktemp -d)
MYAPP=$DEMO/myapp
mkdir -p $MYAPP
cd $MYAPP

cat <<EOF >kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: my-namespace

generators:
 - secret-generator.yaml

secretGenerator:
  - name: my-credentials-pristine
    literals:
      - MY_SECRET=org.org.my-topic

EOF

cat <<EOF >secret-generator.yaml
# Create a local Kubernetes Secret
apiVersion: viaduct.ai/v1
kind: ksops
metadata:
  name: secret-generator
  annotations:
    config.kubernetes.io/function: |
        exec:
          path: ksops
secretFrom:
- metadata:
    name: my-credentials-ksops
    annotations:
      kustomize.config.k8s.io/needs-hash: "true"
  literals:
    - MY_SECRET=org.my-topic

EOF

kustomize build --load-restrictor LoadRestrictionsNone --enable-alpha-plugins --enable-exec .
echo "dir: $MYAPP"