apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: aws-registry-credential-cron
spec:
  schedule: "*/1 * * * *"
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 2
  jobTemplate:
    spec:
      backoffLimit: 4
      template:
        spec:
          serviceAccountName: ecr-creds-agent
          terminationGracePeriodSeconds: 0
          restartPolicy: Never
          containers:
          - name: ecr-creds-job
            imagePullPolicy: IfNotPresent
            securityContext:
              runAsUser: 1001
            image: docker-registry.default.svc:5000/test2/ocp-awscli:1
            command:
            - "/bin/sh"
            - "-c"
            - |
              AWS_ACCOUNT=005459661421
              AWS_REGION=eu-west-1
              DOCKER_REGISTRY_SERVER=https://${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
              DOCKER_USER=AWS
              DOCKER_PASSWORD=`aws ecr get-login --region ${AWS_REGION} --registry-ids ${AWS_ACCOUNT} | cut -d' ' -f6`
              TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
              oc login --insecure-skip-tls-verify https://${KUBERNETES_SERVICE_HOST}:443 --token=$TOKEN
              oc project
              oc delete secret aws-registry || true
              oc create secret docker-registry aws-registry \
              --docker-server=$DOCKER_REGISTRY_SERVER \
              --docker-username=$DOCKER_USER \
              --docker-password=$DOCKER_PASSWORD \
              --docker-email=no@email.local
              oc patch serviceaccount default -p '{"imagePullSecrets":[{"name":"aws-registry"}]}'