---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
    app: vault-agent
    app.kubernetes.io/instance: meertime
  name: secrets-integrator-meertime
  namespace: meertime
spec:
  schedule: "* * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 5
  concurrencyPolicy: Forbid
  jobTemplate:
    metadata:
      labels:
        app: vault-kube-integrator
    spec:
      backoffLimit: 1
      template:
        metadata:
          annotations:
            vault.hashicorp.com/agent-init-first: "true"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only : "true"
            vault.hashicorp.com/agent-inject-secret-db-config-secret.yaml: meertime/kv/db-config
            vault.hashicorp.com/agent-inject-secret-db-control-secret.yaml: meertime/kv/db-control
            vault.hashicorp.com/agent-inject-secret-db-root-credentials.yaml: meertime/kv/dbroot
            vault.hashicorp.com/agent-inject-secret-django-multi-secret.yaml: meertime/kv/django-multi
            vault.hashicorp.com/agent-inject-secret-regcred.yaml: nexus/kv/docker
            vault.hashicorp.com/agent-inject-template-db-config-secret.yaml: |
              {{- with secret "meertime/kv/db-config" -}}
              apiVersion: v1
              kind: Secret
              type: Opaque
              data:
                {{ range $k, $v := .Data.data }}
                {{ $k }}: {{ $v }}
                {{ end }}
              metadata:
                namespace: meertime
                name: db-config
              {{- end }}
            vault.hashicorp.com/agent-inject-template-db-control-secret.yaml: |
              {{- with secret "meertime/kv/db-control" -}}
              apiVersion: v1
              kind: Secret
              type: Opaque
              data:
                {{ range $k, $v := .Data.data }}
                {{ $k }}: {{ $v }}
                {{ end }}
              metadata:
                namespace: meertime
                name: db-control
              {{- end }}
            vault.hashicorp.com/agent-inject-template-db-root-credentials.yaml:
              |
              {{- with secret "meertime/kv/dbroot" -}}
              apiVersion: v1
              kind: Secret
              type: Opaque
              data:
                password: {{ .Data.data.password }}
              metadata:
                namespace: meertime
                name: db-root-credentials
              {{- end }}
            vault.hashicorp.com/agent-inject-template-django-multi-secret.yaml:
              |
              {{- with secret "meertime/kv/django-multi" -}}
              apiVersion: v1
              kind: Secret
              type: Opaque
              data:
                {{ range $k, $v := .Data.data }}
                {{ $k }}: {{ $v }}
                {{ end }}
              metadata:
                namespace: meertime
                name: django-multi
              {{- end }}
            vault.hashicorp.com/agent-inject-template-regcred.yaml: |
              {{- with secret "nexus/kv/docker" -}}
              apiVersion: v1
              kind: Secret
              data:
                .dockerconfigjson: {{ .Data.data.auth }}
              metadata:
                namespace: meertime
                name: meertime-regcred
              type: kubernetes.io/dockerconfigjson
              {{- end }}
            vault.hashicorp.com/role: meertime
        spec:
          containers:
            - name: meertime-vault-kube-integrator
              image: "bitnami/kubectl:1.17.4"
              imagePullPolicy: "IfNotPresent"
              command:
                - kubectl
                - apply
                - "-f"
                - /vault/secrets/
              resources: {}
          imagePullSecrets:
            - name: regcred
          restartPolicy: Never
          serviceAccountName: meertime
