From 9cf52ee558e4ebaec9e68397871edafa3ef8af4e Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Wed, 4 Sep 2024 15:14:12 +0200
Subject: [PATCH] feat(setup): Add support for ecr token helper

---
 helm/cluster_setup/Chart.yaml                 |  6 +-
 .../templates/ecr-token-helper.yaml           | 95 +++++++++++++++++++
 helm/cluster_setup/values.yaml                |  8 ++
 3 files changed, 106 insertions(+), 3 deletions(-)
 create mode 100644 helm/cluster_setup/templates/ecr-token-helper.yaml

diff --git a/helm/cluster_setup/Chart.yaml b/helm/cluster_setup/Chart.yaml
index ec2f795..e60b62b 100644
--- a/helm/cluster_setup/Chart.yaml
+++ b/helm/cluster_setup/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: cluster_setup
-version: 0.5.2
+version: 0.6.0
 type: application
 description: "Initial cluster setup"
 maintainers:
@@ -8,8 +8,8 @@ maintainers:
     url: https://2martens.de
 annotations:
   artifacthub.io/changes: |
-    - kind: fixed
-      description: Pass correct context to helpers
+    - kind: added
+      description: Add support for ECR private registries
   artifacthub.io/signKey: |
     fingerprint: F0F153B65BAD467201D7544E47393ABD1F96B7C8
     url: https://mafiasi.de/pks/key/47393ABD1F96B7C8.asc
diff --git a/helm/cluster_setup/templates/ecr-token-helper.yaml b/helm/cluster_setup/templates/ecr-token-helper.yaml
new file mode 100644
index 0000000..2410dad
--- /dev/null
+++ b/helm/cluster_setup/templates/ecr-token-helper.yaml
@@ -0,0 +1,95 @@
+{{- if .Values.ecr.enabled -}}
+{{- range .Values.ecr.applicationNamespaces }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .name }}
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+      - serviceaccounts
+      - serviceaccounts/token
+    verbs:
+      - 'delete'
+      - 'create'
+      - 'patch'
+      - 'get'
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: sa-ecr-token-helper
+roleRef:
+  kind: Role
+  name: ecr-token-helper
+  apiGroup: ""
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sa-ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+spec:
+  schedule: '0 */6 * * *'
+  successfulJobsHistoryLimit: 0
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: sa-ecr-token-helper
+          containers:
+            - command:
+                - /bin/sh
+                - -c
+                - |-
+                  TOKEN=`aws ecr get-login-password --region ${REGION} | cut -d' ' -f6`
+                  kubectl delete secret -n <namespace> --ignore-not-found $SECRET_NAME
+                  kubectl create secret -n <namespace> docker-registry $SECRET_NAME \
+                  --docker-server=$ECR_REPOSITORY \
+                  --docker-username=AWS \
+                  --docker-password=$TOKEN \
+                  --namespace={{ .name }}
+                  kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}' -n {{ .name }}
+              env:
+                - name: AWS_SECRET_ACCESS_KEY
+                  value: {{- $.Values.ecr.accessKey.secret }}
+                - name: AWS_ACCESS_KEY_ID
+                  value: {{- $.Values.ecr.accessKey.id }}
+                - name: ACCOUNT
+                  value: {{- $.Values.ecr.account }}
+                - name: SECRET_NAME
+                  value: 'ecrcred'
+                - name: REGION
+                  value: eu-central-1
+                - name: ECR_REPOSITORY
+                  value: {{ $.Values.ecr.repository }}
+              image: gtsopour/awscli-kubectl:latest
+              imagePullPolicy: IfNotPresent
+              name: ecr-token-helper
+          restartPolicy: Never
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm/cluster_setup/values.yaml b/helm/cluster_setup/values.yaml
index 5cb78d1..0363025 100644
--- a/helm/cluster_setup/values.yaml
+++ b/helm/cluster_setup/values.yaml
@@ -5,6 +5,14 @@ vault:
   clientSecret: ""
   # creates each of the namespaces
   applicationNamespaces: []
+ecr:
+  enabled: false
+  account: ""
+  accessKey:
+    id: ""
+    secret: ""
+  repository: ""
+  applicationNamespaces: []
 hcloud:
   enabled: false
   token: ""