82 lines
3.2 KiB
YAML
82 lines
3.2 KiB
YAML
# services/health/sparkyfitness-oidc-config-cronjob.yaml
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: sparkyfitness-oidc-config
|
|
namespace: health
|
|
spec:
|
|
schedule: "*/30 * * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 1
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/role: "health"
|
|
vault.hashicorp.com/agent-inject-secret-sparky-oidc-env: "kv/data/atlas/health/sparkyfitness-admin"
|
|
vault.hashicorp.com/agent-inject-template-sparky-oidc-env: |
|
|
{{- with secret "kv/data/atlas/health/sparkyfitness-admin" -}}
|
|
export SPARKYFITNESS_ADMIN_EMAIL="{{ .Data.data.email }}"
|
|
export SPARKYFITNESS_ADMIN_PASSWORD="{{ .Data.data.password }}"
|
|
{{- end }}
|
|
{{- with secret "kv/data/atlas/health/sparkyfitness-oidc" -}}
|
|
export SPARKYFITNESS_OIDC_CLIENT_ID="{{ .Data.data.client_id }}"
|
|
export SPARKYFITNESS_OIDC_CLIENT_SECRET="{{ .Data.data.client_secret }}"
|
|
export SPARKYFITNESS_OIDC_ISSUER_URL="{{ .Data.data.issuer_url }}"
|
|
{{- end -}}
|
|
spec:
|
|
serviceAccountName: health-vault-sync
|
|
restartPolicy: Never
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/arch
|
|
operator: In
|
|
values: ["arm64"]
|
|
- key: node-role.kubernetes.io/worker
|
|
operator: Exists
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 90
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values: ["rpi5"]
|
|
- weight: 70
|
|
preference:
|
|
matchExpressions:
|
|
- key: hardware
|
|
operator: In
|
|
values: ["rpi4"]
|
|
containers:
|
|
- name: configure
|
|
image: alpine:3.20
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -euo pipefail
|
|
apk add --no-cache bash curl jq >/dev/null
|
|
. /vault/secrets/sparky-oidc-env
|
|
exec /scripts/sparkyfitness_oidc_configure.sh
|
|
env:
|
|
- name: SPARKYFITNESS_BASE_URL
|
|
value: http://sparkyfitness-server.health.svc.cluster.local:3010
|
|
- name: SPARKYFITNESS_FRONTEND_URL
|
|
value: https://sparkyfitness.bstein.dev
|
|
volumeMounts:
|
|
- name: sparkyfitness-oidc-config-script
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
volumes:
|
|
- name: sparkyfitness-oidc-config-script
|
|
configMap:
|
|
name: sparkyfitness-oidc-config-script
|
|
defaultMode: 0555
|