#!/usr/bin/env bash
# Fetch kubeconfig.sops from Hetzner Object Storage and decrypt to ~/.kube/config.
# Used by every Woodpecker step that needs cluster access (the e2e pipelines).
#
# Required env (typically from_secret in the calling pipeline):
#   S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY  — Hetzner Object Storage keypair
#   SOPS_AGE_KEY                            — age private key (Flux/CI keyring)
set -euo pipefail

: "${S3_ACCESS_KEY_ID:?S3_ACCESS_KEY_ID not set}"
: "${S3_SECRET_ACCESS_KEY:?S3_SECRET_ACCESS_KEY not set}"
: "${SOPS_AGE_KEY:?SOPS_AGE_KEY not set}"

mkdir -p ~/.config/sops/age ~/.kube
echo "$SOPS_AGE_KEY" > ~/.config/sops/age/keys.txt

TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY_ID" \
AWS_SECRET_ACCESS_KEY="$S3_SECRET_ACCESS_KEY" \
AWS_DEFAULT_REGION=fsn1 \
  aws --endpoint-url https://fsn1.your-objectstorage.com \
      s3 cp s3://renner-uno-k8s-secrets/cluster-access/kubeconfig.sops "$TMP"

sops -d --input-type binary --output-type binary "$TMP" > ~/.kube/config
chmod 600 ~/.kube/config