cloud-configuration/helm/cluster_setup/templates/ecr-token-helper.yaml

{{- if .Values.ecr.enabled -}}
{{- range .Values.ecr.applicationNamespaces }}
---
apiVersion: v1
kind: Namespace
metadata:
  name: {{ .name }}
  labels:
    {{- include "template.labels" $ | nindent 4 }}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ecr-token-helper
  labels:
    {{- include "template.labels" $ | nindent 4 }}
rules:
  - apiGroups: [""]
    resources:
      - secrets
      - serviceaccounts
      - serviceaccounts/token
    verbs:
      - 'delete'
      - 'create'
      - 'patch'
      - 'get'
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ecr-token-helper
  labels:
    {{- include "template.labels" $ | nindent 4 }}
subjects:
  - kind: ServiceAccount
    name: sa-ecr-token-helper
roleRef:
  kind: Role
  name: ecr-token-helper
  apiGroup: ""
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-ecr-token-helper
  labels:
    {{- include "template.labels" $ | nindent 4 }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ecr-token-helper
  labels:
    {{- include "template.labels" $ | nindent 4 }}
spec:
  schedule: '0 */6 * * *'
  successfulJobsHistoryLimit: 0
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: sa-ecr-token-helper
          containers:
            - command:
                - /bin/sh
                - -c
                - |-
                  TOKEN=`aws ecr get-login-password --region ${REGION} | cut -d' ' -f6`
                  kubectl delete secret -n <namespace> --ignore-not-found $SECRET_NAME
                  kubectl create secret -n <namespace> docker-registry $SECRET_NAME \
                  --docker-server=$ECR_REPOSITORY \
                  --docker-username=AWS \
                  --docker-password=$TOKEN \
                  --namespace={{ .name }}
                  kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}' -n {{ .name }}
              env:
                - name: AWS_SECRET_ACCESS_KEY
                  value: {{- $.Values.ecr.accessKey.secret }}
                - name: AWS_ACCESS_KEY_ID
                  value: {{- $.Values.ecr.accessKey.id }}
                - name: ACCOUNT
                  value: {{- $.Values.ecr.account }}
                - name: SECRET_NAME
                  value: 'ecrcred'
                - name: REGION
                  value: eu-central-1
                - name: ECR_REPOSITORY
                  value: {{ $.Values.ecr.repository }}
              image: gtsopour/awscli-kubectl:latest
              imagePullPolicy: IfNotPresent
              name: ecr-token-helper
          restartPolicy: Never
{{- end }}
{{- end }}