cloud-configuration/helm/cluster_setup/templates/ecr-token-helper.yaml

{{- if .Values.ecr.enabled -}}
{{- range .Values.ecr.applicationNamespaces -}}
---
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ecr-token-helper
  namespace: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
rules:
  - apiGroups: [""]
    resources:
      - secrets
      - serviceaccounts
      - serviceaccounts/token
    verbs:
      - 'delete'
      - 'create'
      - 'patch'
      - 'get'
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ecr-token-helper
  namespace: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
subjects:
  - kind: ServiceAccount
    name: sa-ecr-token-helper
roleRef:
  kind: Role
  name: ecr-token-helper
  apiGroup: ""
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-ecr-token-helper
  namespace: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: aws-credentials
  namespace: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
data:
  AWS_ACCESS_KEY_ID: {{ $.Values.ecr.accessKey.id | b64enc }}
  AWS_SECRET_ACCESS_KEY: {{ $.Values.ecr.accessKey.secret | b64enc }}
  ACCOUNT: {{ $.Values.ecr.account | b64enc }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ecr-token-helper
  namespace: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
spec:
  schedule: '0 */6 * * *'
  successfulJobsHistoryLimit: 0
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: sa-ecr-token-helper
          containers:
            - command:
                - /bin/sh
                - -c
                - |-
                  TOKEN=`aws ecr get-login-password --region ${REGION} | cut -d' ' -f6`
                  kubectl delete secret -n {{ .name }} --ignore-not-found $SECRET_NAME
                  kubectl create secret -n {{ .name }} docker-registry $SECRET_NAME \
                  --docker-server=$ECR_REPOSITORY \
                  --docker-username=AWS \
                  --docker-password=$TOKEN \
                  --namespace={{ .name }}
                  kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}' -n {{ .name }}
              env:
                - name: SECRET_NAME
                  value: 'ecrcred'
                - name: REGION
                  value: eu-central-1
                - name: ECR_REPOSITORY
                  value: {{ $.Values.ecr.repository }}
              envFrom:
                - secretRef:
                    name: aws-credentials
              image: gtsopour/awscli-kubectl:latest
              imagePullPolicy: IfNotPresent
              name: ecr-token-helper
          restartPolicy: Never
{{- end }}
{{- end }}