apiVersion: apps/v1
kind: Deployment
metadata:
  name: bootstrap-autoapprover
  namespace: openshift-infra
spec:
  replicas: 1
  selector:
    matchLabels:
      app: bootstrap-autoapprover
  template:
    metadata:
      labels:
        app: bootstrap-autoapprover
    spec:
      serviceAccountName: bootstrap-autoapprover
      containers:
      - args:
        - |
          set -o errexit
          set -o nounset
          set -o pipefail

          cat <<'SCRIPT' >/tmp/signer
          #!/bin/bash
          #
          # It will approve any CSR that is not approved yet, and delete any CSR that expired more than 60 seconds
          # ago.
          #

          set -o errexit
          set -o nounset
          set -o pipefail

          name=$1
          condition=$2
          certificate=$3
          username=$4

          # auto approve
          if [[ -z "$condition" && ("$username" == "system:serviceaccount:openshift-infra:node-bootstrapper" || "$username" == "system:node:"* ) ]]; then
            oc adm certificate approve "$name"
            exit 0
          fi

          # check certificate age
          if [[ -n "$certificate" ]]; then
            text="$( echo "$certificate" | base64 -d - )"
            if ! echo "$text" | openssl x509 -noout; then
              echo "error: Unable to parse certificate"
              exit 1
            fi
            if ! echo "$text" | openssl x509 -checkend -60 >/dev/null; then
              echo "Certificate is expired, deleting"
              oc delete csr "$name"
            fi
            exit 0
          fi
          SCRIPT

          chmod u+x /tmp/signer
          exec oc observe csr --maximum-errors=1 --resync-period=10m -a '{.status.conditions[*].type}' -a '{.status.certificate}' -a '{.spec.username}' -- /tmp/signer
        command:
        - /bin/bash
        - -c
        image: '*** GENERATED ***'
        name: signer
      nodeSelector:
        node-role.kubernetes.io/master: "true"