61 lines
1.6 KiB
YAML
61 lines
1.6 KiB
YAML
|
# PostSync Job to copy ddb-cluster-app credentials to iam namespace
|
||
|
|
# Allows authentik to reference 'app' user credentials locally
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: sync-db-credentials
|
||
|
|
namespace: iam
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: secret-copier
|
||
|
|
rules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["secrets"]
|
||
|
|
verbs: ["get", "create", "update", "patch"]
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: sync-db-credentials
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: sync-db-credentials
|
||
|
|
namespace: iam
|
||
|
|
roleRef:
|
||
|
|
kind: ClusterRole
|
||
|
|
name: secret-copier
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
---
|
||
|
|
apiVersion: batch/v1
|
||
|
|
kind: Job
|
||
|
|
metadata:
|
||
|
|
name: sync-db-credentials
|
||
|
|
namespace: iam
|
||
|
|
annotations:
|
||
|
|
argocd.argoproj.io/hook: PostSync
|
||
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||
|
|
spec:
|
||
|
|
backoffLimit: 3
|
||
|
|
template:
|
||
|
|
spec:
|
||
|
|
serviceAccountName: sync-db-credentials
|
||
|
|
restartPolicy: Never
|
||
|
|
containers:
|
||
|
|
- name: copy-secret
|
||
|
|
image: alpine/k8s:1.30.3
|
||
|
|
command:
|
||
|
|
- /bin/sh
|
||
|
|
- -c
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
echo "Copying ddb-cluster-app secret from ddb to iam namespace..."
|
||
|
|
|
||
|
|
# Get secret from ddb namespace
|
||
|
|
kubectl get secret ddb-cluster-app -n ddb -o json | \
|
||
|
|
jq 'del(.metadata.namespace, .metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp, .metadata.ownerReferences) | .metadata.namespace="iam"' | \
|
||
|
|
kubectl apply -f -
|
||
|
|
|
||
|
|
echo "Secret copied successfully"
|