---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: lego-renew
  namespace: "${NAMESPACE}"
spec:
  schedule: "0 0 * * *"
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          initContainers:
            - name: lego
              image: boxboat/lego:${LEGO_VERSION}
              args:
                - --accept-tos
                - --email=${EMAIL}
                - --domains=${DOMAIN_1}
                - --domains=${DOMAIN_2}
                - --dns=route53
                - renew
                - --days=30
              env:
                - name: AWS_REGION
                  value: us-east-1
                - name: AWS_ACCESS_KEY_ID
                  valueFrom:
                    secretKeyRef:
                      name: lego-aws
                      key: access-key-id
                - name: AWS_SECRET_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: lego-aws
                      key: secret-access-key
              volumeMounts:
                - name: lego-nfs
                  mountPath: /home/alpine/.lego
          containers:
            - name: kubectl
              image: boxboat/kubectl:${KUBECTL_VERSION}
              command:
                - sh
                - -c
                - >
                  kubectl create secret tls "${TLS_SECRET}"
                  -n "${NAMESPACE}"
                  --cert=.lego/certificates/${CERT_NAME}.crt
                  --key=.lego/certificates/${CERT_NAME}.key
                  --dry-run
                  -o yaml | kubectl apply -f - && \
                  kubectl -n "${NAMESPACE}" label secrets "${TLS_SECRET}" ${REPLICATE_LABEL_NAME}="${REPLICATE_LABEL_VALUE}"
              volumeMounts:
                - name: lego-nfs
                  mountPath: /home/alpine/.lego
          restartPolicy: Never
          serviceAccountName: lego
          volumes:
            - name: lego-nfs
              persistentVolumeClaim:
                claimName: lego-nfs
