From 7df212a64925332c25c58e99cc0526440f24a0da Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Wed, 4 Sep 2024 15:34:26 +0200
Subject: [PATCH] fix(setup): Fix configuration for ecr credential helper

---
 helm/cluster_setup/Chart.yaml                 |  6 ++--
 .../templates/ecr-token-helper.yaml           | 28 ++++++++++++++-----
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/helm/cluster_setup/Chart.yaml b/helm/cluster_setup/Chart.yaml
index e60b62b..e2f95d9 100644
--- a/helm/cluster_setup/Chart.yaml
+++ b/helm/cluster_setup/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: cluster_setup
-version: 0.6.0
+version: 0.6.1
 type: application
 description: "Initial cluster setup"
 maintainers:
@@ -8,8 +8,8 @@ maintainers:
     url: https://2martens.de
 annotations:
   artifacthub.io/changes: |
-    - kind: added
-      description: Add support for ECR private registries
+    - kind: fixed
+      description: Fixed ecr configuration
   artifacthub.io/signKey: |
     fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
     url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc
diff --git a/helm/cluster_setup/templates/ecr-token-helper.yaml b/helm/cluster_setup/templates/ecr-token-helper.yaml
index 2410dad..6b66c91 100644
--- a/helm/cluster_setup/templates/ecr-token-helper.yaml
+++ b/helm/cluster_setup/templates/ecr-token-helper.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.ecr.enabled -}}
-{{- range .Values.ecr.applicationNamespaces }}
+{{- range .Values.ecr.applicationNamespaces -}}
 ---
 apiVersion: v1
 kind: Namespace
@@ -12,6 +12,7 @@ kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: ecr-token-helper
+  namespace: {{ .name }}
   labels:
     {{- include "template.labels" $ | nindent 4 }}
 rules:
@@ -30,6 +31,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: ecr-token-helper
+  namespace: {{ .name }}
   labels:
     {{- include "template.labels" $ | nindent 4 }}
 subjects:
@@ -44,13 +46,28 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: sa-ecr-token-helper
+  namespace: {{ .name }}
   labels:
     {{- include "template.labels" $ | nindent 4 }}
 ---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: aws-credentials
+  namespace: {{ .name }}
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+data:
+  AWS_ACCESS_KEY_ID: {{ $.Values.ecr.accessKey.id | b64enc }}
+  AWS_SECRET_ACCESS_KEY: {{ $.Values.ecr.accessKey.secret | b64enc }}
+  ACCOUNT: {{ $.Values.ecr.account | b64enc }}
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: ecr-token-helper
+  namespace: {{ .name }}
   labels:
     {{- include "template.labels" $ | nindent 4 }}
 spec:
@@ -75,18 +92,15 @@ spec:
                   --namespace={{ .name }}
                   kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}' -n {{ .name }}
               env:
-                - name: AWS_SECRET_ACCESS_KEY
-                  value: {{- $.Values.ecr.accessKey.secret }}
-                - name: AWS_ACCESS_KEY_ID
-                  value: {{- $.Values.ecr.accessKey.id }}
-                - name: ACCOUNT
-                  value: {{- $.Values.ecr.account }}
                 - name: SECRET_NAME
                   value: 'ecrcred'
                 - name: REGION
                   value: eu-central-1
                 - name: ECR_REPOSITORY
                   value: {{ $.Values.ecr.repository }}
+              envFrom:
+                - secretRef:
+                    name: aws-credentials
               image: gtsopour/awscli-kubectl:latest
               imagePullPolicy: IfNotPresent
               name: ecr-token-helper