ecr.template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: project-request
  namespace: openshift-config
objects:
- apiVersion: project.openshift.io/v1
  kind: Project
  metadata:
    annotations:
      openshift.io/description: ${PROJECT_DESCRIPTION}
      openshift.io/display-name: ${PROJECT_DISPLAYNAME}
      openshift.io/requester: ${PROJECT_REQUESTING_USER}
    creationTimestamp: null
    name: ${PROJECT_NAME}
  spec: {}
  status: {}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    creationTimestamp: null
    name: admin
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: ${PROJECT_ADMIN_USER}
- apiVersion: batch/v1
  kind: CronJob
  metadata:
    name: ecr-creds-rotator
  spec:
    concurrencyPolicy: Replace
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        template:
          spec:
            containers:
            - command:
              - /bin/sh
              - -c
              - |-
                ECR_TOKEN=`aws ecr get-login-password --region ${AWS_REGION}`
                oc create secret docker-registry $ECR_SECRET_NAME \
                --docker-server=${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com \
                --docker-username=AWS \
                --docker-password="${ECR_TOKEN}" \
                --dry-run=client -o yaml | oc apply -f -
                oc secret link default ecr-secret --for=pull
                oc secret link builder ecr-secret --for=pull,mount
              envFrom:
              - secretRef:
                  name: ecr-creds-rotator-secret
              - configMapRef:
                  name: ecr-creds-rotator-cm
              image: image-registry.openshift-image-registry.svc:5000/aws-oc-build/aws-oc-cli:latest
              imagePullPolicy: IfNotPresent
              name: ecr-creds-rotator
            restartPolicy: Never
            serviceAccountName: ecr-creds-rotator-sa
    schedule: '*/5 * * * *'
    successfulJobsHistoryLimit: 1
    suspend: false
- apiVersion: batch/v1
  kind: Job
  metadata:
    name: ecr-creds-rotator-init
  spec:
    backoffLimit: 3
    completions: 1
    template:
      spec:
        containers:
        - command:
          - /bin/sh
          - -c
          - |-
            ECR_TOKEN=`aws ecr get-login-password --region ${AWS_REGION}`
            oc create secret docker-registry $ECR_SECRET_NAME \
            --docker-server=${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com \
            --docker-username=AWS \
            --docker-password="${ECR_TOKEN}" \
            --dry-run=client -o yaml | oc apply -f -
            oc secret link default ecr-secret --for=pull
            oc secret link builder ecr-secret --for=pull,mount
          envFrom:
          - secretRef:
              name: ecr-creds-rotator-secret
          - configMapRef:
              name: ecr-creds-rotator-cm
          image: image-registry.openshift-image-registry.svc:5000/aws-oc-build/aws-oc-cli:latest
          imagePullPolicy: IfNotPresent
          name: ecr-creds-rotator-init
        restartPolicy: Never
        serviceAccountName: ecr-creds-rotator-sa
    ttlSecondsAfterFinished: 300
- apiVersion: v1
  kind: Secret
  metadata:
    name: ecr-creds-rotator-secret
  stringData:
    AWS_ACCESS_KEY_ID: ""
    AWS_ACCOUNT: ""
    AWS_SECRET_ACCESS_KEY: ""
- apiVersion: v1
  data:
    AWS_REGION: ""
    ECR_SECRET_NAME: ecr-secret
  kind: ConfigMap
  metadata:
    name: ecr-creds-rotator-cm
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: ecr-creds-rotator-sa
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: role-update-secrets
  rules:
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - create
    - delete
    - get
    - patch
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs:
    - get
    - update
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: ecr-creds-rotator-rolebinding
  roleRef:
    apiGroup: ""
    kind: Role
    name: role-update-secrets
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: ecr-creds-rotator-sa
parameters:
- name: PROJECT_NAME
- name: PROJECT_DISPLAYNAME
- name: PROJECT_DESCRIPTION
- name: PROJECT_ADMIN_USER
- name: PROJECT_REQUESTING_USER