helm

#!/bin/bash
if [[ $1 = install  ||  $1 = template  ||  $1 = upgrade  ||  $1 = lint  ||  $1 = diff ]]
then
#this section is needed to assume an IAM role using a web identity , as a result of assigning an IAM role to the service account. Only needed if you use KMS to encrypt your secrets, if you choose to configure the role as such: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
#this is needed because helm secrets, or more specifically sops(?), does not support assuming roles with web identities. so we must first assume it manually
#keep in mind you will also need to add a security context to the repo server deployment, to allow the argocd user access to the token file(this is already done in this repo's install.yaml): https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
	aws sts assume-role-with-web-identity \
 	--role-arn $AWS_ROLE_ARN \
	--role-session-name argocd \
	--web-identity-token file://$AWS_WEB_IDENTITY_TOKEN_FILE \
	--duration-seconds 1000 > /tmp/irp-cred.txt

	export AWS_ACCESS_KEY_ID="$(cat /tmp/irp-cred.txt | jq -r ".Credentials.AccessKeyId")"
	export AWS_SECRET_ACCESS_KEY="$(cat /tmp/irp-cred.txt | jq -r ".Credentials.SecretAccessKey")"
	export AWS_SESSION_TOKEN="$(cat /tmp/irp-cred.txt | jq -r ".Credentials.SessionToken")"
	rm /tmp/irp-cred.txt

	helm3 secrets $@ | sed '/removed.*/d'
else
	helm3 $@
fi