---
apiVersion: batch/v1
kind: Job
metadata:
  name: lego-generate
  namespace: "${NAMESPACE}"
spec:
  backoffLimit: 2
  template:
    spec:
      initContainers:
      - name: lego
        image: boxboat/lego:${LEGO_VERSION}
        args:
        - --accept-tos
        - --email=${EMAIL}
        - --domains=${DOMAIN_1}
        - --domains=${DOMAIN_2}
        - --dns=route53
        - run
        env:
        - name: AWS_REGION
          value: us-east-1
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: lego-aws
              key: access-key-id
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: lego-aws
              key: secret-access-key
        volumeMounts:
        - name: lego-nfs
          mountPath: /home/alpine/.lego
      containers:
      - name: kubectl
        image: boxboat/kubectl:${KUBECTL_VERSION}
        command:
        - sh
        - -c
        - >
          kubectl create secret tls "${TLS_SECRET}"
          -n "${NAMESPACE}"
          --cert=.lego/certificates/${CERT_NAME}.crt
          --key=.lego/certificates/${CERT_NAME}.key
          --dry-run
          -o yaml | kubectl apply -f -
        volumeMounts:
        - name: lego-nfs
          mountPath: /home/alpine/.lego
      restartPolicy: Never
      serviceAccountName: lego
      volumes:
      - name: lego-nfs
        persistentVolumeClaim:
          claimName: lego-nfs
