kubectl -n argocd get secret gcp-sa -o json \
  | jq -r '.data["application-credentials.json"]' \
  | base64 --decode > /tmp/gcp-sa.json

export GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp-sa.json

# Vertex stack (state backend is GCS; pass your bucket name)
cd ai-infra/vertex
terraform init -backend-config="bucket=$TF_STATE_BUCKET" -backend-config="prefix=vertex"
terraform apply -auto-approve \
  -var "project_id=$PROJECT_ID" \
  -var "region=europe-west4" \
  -var "location=europe-west4" \
  -var "endpoint_display_name=echo-ai-endpoint"

rm -f /tmp/gcp-sa.json
unset GOOGLE_APPLICATION_CREDENTIALS