services/communication/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - synapse-rendered.yaml
   - synapse-signingkey-ensure-job.yaml
   - mas-configmap.yaml
+  - mas-admin-client-secret.yaml
   - mas-admin-client-secret-ensure-job.yaml
   - mas-deployment.yaml
   - mas-ingress.yaml

services/communication/mas-admin-client-secret-ensure-job.yaml

@@ -13,11 +13,8 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
-    resourceNames: ["mas-admin-client-runtime"]
+    resourceNames: ["mas-admin-client"]
     verbs: ["get", "patch", "update"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["create"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -36,7 +33,7 @@ subjects:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-admin-client-secret-ensure-7
+  name: mas-admin-client-secret-ensure-6
   namespace: comms
 spec:
   backoffLimit: 2
@@ -67,18 +64,12 @@ spec:
           args:
             - |
               set -euo pipefail
-              if kubectl -n comms get secret mas-admin-client-runtime >/dev/null 2>&1; then
-                if kubectl -n comms get secret mas-admin-client-runtime -o jsonpath='{.data.client_secret}' 2>/dev/null | grep -q .; then
-                  exit 0
-                fi
-              else
-                kubectl -n comms create secret generic mas-admin-client-runtime \
-                  --from-file=client_secret=/work/client_secret >/dev/null
+              if kubectl -n comms get secret mas-admin-client -o jsonpath='{.data.client_secret}' 2>/dev/null | grep -q .; then
                 exit 0
               fi
               secret_b64="$(base64 /work/client_secret | tr -d '\n')"
               payload="$(printf '{"data":{"client_secret":"%s"}}' "${secret_b64}")"
-              kubectl -n comms patch secret mas-admin-client-runtime --type=merge -p "${payload}" >/dev/null
+              kubectl -n comms patch secret mas-admin-client --type=merge -p "${payload}" >/dev/null
           volumeMounts:
             - name: work
               mountPath: /work

services/communication/mas-admin-client-secret.yaml

@@ -0,0 +1,7 @@
+# services/communication/mas-admin-client-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mas-admin-client
+  namespace: comms
+type: Opaque