#!/bin/bash
set -e
set -o pipefail

# Retrieve a secret from berglas, decode it, extract part of the YAML that is
# then further base64 decoded and written to an output file.
#
# The yaml path uses `yq` path notation to pull out elements. For example, to
# pull out the service account key from a kubernetes secret you would pass
# '.data."key.json"' as the YAML_PATH.

if [ $# -ne 4 ]; then
    echo "$0 <cluster-name> <secret-name> <yaml path> <output file>"
    exit 1
fi

CLUSTER=$1
SECRET_NAME=$2
YAML_PATH=$3
FILENAME=$4

REL=$(dirname "$0")
source ${REL}/config.sh

berglas access ${BUCKET_ID}/${CLUSTER}/${SECRET_NAME} \
| base64 --decode \
| yq e ${YAML_PATH} - \
| base64 -d > ${FILENAME}