-
Notifications
You must be signed in to change notification settings - Fork 2
/
cap-cronjob.yaml
67 lines (67 loc) · 2.65 KB
/
cap-cronjob.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: cap-token-refresh
namespace: cap-token-refresh
spec:
schedule: "*/30 * * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: cap-token-refresh
image: quay.io/staebler/cap-token-refresh
imagePullPolicy: IfNotPresent
env:
- name: CAP_URL
value: "https://cap.digitalageexperts.com/api/v1/credentials"
- name: AGENCY
value: "SHIFT"
- name: MISSION
value: "OpenShiftGovCloudEmu"
args:
- /bin/sh
- -c
- |
readarray -t secrets <<< \
"$(oc get credentialsrequest -A -ojson | \
jq -r '.items[] | select(.spec.providerSpec.kind == "AWSProviderSpec") | .spec.secretRef | .namespace, .name')"
secret_namespace=""
secret_name=""
for i in "${secrets[@]}"
do
if [ -z "${secret_namespace}" ]
then
secret_namespace="${i}"
else
secret_name="${i}"
role="$(oc extract -n ${secret_namespace} secret/${secret_name} --keys=role --to=-)"
if [ $? -ne 0 ]
then
echo "Missing ${secret_namespace}/${secret_name} secret"
elif [ -z "${role}" ]
then
echo "Missing role in ${secret_namespace}/${secret_name} secret"
else
echo "Updating creds in ${secret_namespace}/${secret_name} secret"
curl "${CAP_URL}?agency=${AGENCY}&mission=${MISSION}&role=${role}" \
--cert /etc/cap-certs/cap.pem \
--key /etc/cap-certs/cap.key \
--cacert /etc/cap-certs/ca-chain.cert.pem | \
jq '.Credentials | {"stringData":{"aws_access_key_id":.AccessKeyId,"aws_secret_access_key":.SecretAccessKey,"credentials":("[default]\naws_access_key_id = "+.AccessKeyId+"\naws_secret_access_key = "+.SecretAccessKey+"\n")}}' | \
xargs -0 -I {} oc patch -n ${secret_namespace} secret ${secret_name} -p '{}'
fi
secret_namespace=""
secret_name=""
fi
done
volumeMounts:
- name: cap-certs
mountPath: "/etc/cap-certs"
restartPolicy: OnFailure
serviceAccountName: cap-token-refresh
volumes:
- name: cap-certs
secret:
secretName: cap-certs