---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: secret-reflector
  namespace: system-network
spec:
  schedule: "0 */12 * * *"
  concurrencyPolicy: "Forbid"
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  jobTemplate:
    spec:
      backoffLimit: 3
      ttlSecondsAfterFinished: 300
      template:
        spec:
          serviceAccountName: sa-secret-reflector
          restartPolicy: Never
          containers:
            - name: secret-reflector
              image: ghcr.io/k8s-at-home/kubectl:v1.23.1
              env:
                - name: SECRETS
                  value: "${SECRET_PUBLIC_DOMAIN/./-}-tls"
              command:
                - "/bin/sh"
                - "/app/secret-reflector.sh"
              volumeMounts:
                - name: secret-reflector
                  mountPath: /app/secret-reflector.sh
                  subPath: secret-reflector.sh
                  readOnly: true
          volumes:
            - name: secret-reflector
              projected:
                defaultMode: 0775
                sources:
                  - configMap:
                      name: secret-reflector
                      items:
                        - key: secret-reflector.sh
                          path: secret-reflector.sh
