feat(setup): Add support for ecr token helper

2026-10-17 16:46:51 +02:00 · 2024-09-04 15:14:12 +02:00
parent 3891e10c45
commit 9cf52ee558
3 changed files with 106 additions and 3 deletions
@@ -0,0 +1,95 @@
+{{- if .Values.ecr.enabled -}}
+{{- range .Values.ecr.applicationNamespaces }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .name }}
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+      - serviceaccounts
+      - serviceaccounts/token
+    verbs:
+      - 'delete'
+      - 'create'
+      - 'patch'
+      - 'get'
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: sa-ecr-token-helper
+roleRef:
+  kind: Role
+  name: ecr-token-helper
+  apiGroup: ""
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sa-ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: ecr-token-helper
+  labels:
+    {{- include "template.labels" $ | nindent 4 }}
+spec:
+  schedule: '0 */6 * * *'
+  successfulJobsHistoryLimit: 0
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: sa-ecr-token-helper
+          containers:
+            - command:
+                - /bin/sh
+                - -c
+                - |-
+                  TOKEN=`aws ecr get-login-password --region ${REGION} | cut -d' ' -f6`
+                  kubectl delete secret -n <namespace> --ignore-not-found $SECRET_NAME
+                  kubectl create secret -n <namespace> docker-registry $SECRET_NAME \
+                  --docker-server=$ECR_REPOSITORY \
+                  --docker-username=AWS \
+                  --docker-password=$TOKEN \
+                  --namespace={{ .name }}
+                  kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}' -n {{ .name }}
+              env:
+                - name: AWS_SECRET_ACCESS_KEY
+                  value: {{- $.Values.ecr.accessKey.secret }}
+                - name: AWS_ACCESS_KEY_ID
+                  value: {{- $.Values.ecr.accessKey.id }}
+                - name: ACCOUNT
+                  value: {{- $.Values.ecr.account }}
+                - name: SECRET_NAME
+                  value: 'ecrcred'
+                - name: REGION
+                  value: eu-central-1
+                - name: ECR_REPOSITORY
+                  value: {{ $.Values.ecr.repository }}
+              image: gtsopour/awscli-kubectl:latest
+              imagePullPolicy: IfNotPresent
+              name: ecr-token-helper
+          restartPolicy: Never
+{{- end }}
+{{- end }}