#!/usr/bin/env bash

set -euo pipefail

project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
version=${DASHBOARD_CHART_VERSION:-7.14.0}
output=${1:?Usage: render.sh OUTPUT_FILE}
chart=$(mktemp)
raw=$(mktemp)
helm_cache=$(mktemp --directory)
trap 'rm -f "${chart}" "${raw}"; rm -rf "${helm_cache}"' EXIT

curl --fail --silent --show-error --location --output "${chart}" \
  "https://github.com/kubernetes-retired/dashboard/releases/download/kubernetes-dashboard-${version}/kubernetes-dashboard-${version}.tgz"

HELM_CACHE_HOME="${helm_cache}" HELM_PLUGINS="${project_dir}/helm-plugins" \
helm template kubernetes-dashboard "${chart}" \
  --namespace kubernetes-dashboard \
  --values "${project_dir}/kubernetes-dashboard-values.yaml" \
  --set-string app.security.csrfKey=ci-render-only-not-used > "${raw}"

# The chart always renders a random CSRF Secret. It is created and retained by
# the bootstrap Helm installation; restricted CI never receives Secret access.
awk -f "${project_dir}/filter-secrets.awk" "${raw}" > "${output}"