#!/usr/bin/env bash
set -euo pipefail

NAMESPACE="${NAMESPACE:-ci-cd}"
SECRET_NAME="${SECRET_NAME:-sla-separacao-env}"

: "${DB_HOST:?DB_HOST is required}"
: "${DB_PORT:?DB_PORT is required}"
: "${DB_NAME:?DB_NAME is required}"
: "${DB_USER:?DB_USER is required}"
: "${DB_PASSWORD:?DB_PASSWORD is required}"
: "${DB_ENCRYPT:?DB_ENCRYPT is required}"
: "${DB_TRUST_SERVER_CERT:?DB_TRUST_SERVER_CERT is required}"
: "${DB_SERVER_NAME:?DB_SERVER_NAME is required}"
: "${SESSION_SECRET:?SESSION_SECRET is required}"

kubectl create secret generic "${SECRET_NAME}" \
  --namespace "${NAMESPACE}" \
  --from-literal=DB_HOST="${DB_HOST}" \
  --from-literal=DB_PORT="${DB_PORT}" \
  --from-literal=DB_NAME="${DB_NAME}" \
  --from-literal=DB_USER="${DB_USER}" \
  --from-literal=DB_PASSWORD="${DB_PASSWORD}" \
  --from-literal=DB_ENCRYPT="${DB_ENCRYPT}" \
  --from-literal=DB_TRUST_SERVER_CERT="${DB_TRUST_SERVER_CERT}" \
  --from-literal=DB_SERVER_NAME="${DB_SERVER_NAME}" \
  --from-literal=SESSION_SECRET="${SESSION_SECRET}" \
  --dry-run=client -o yaml | kubectl apply -f -

echo "Secret ${SECRET_NAME} aplicado no namespace ${NAMESPACE}."