apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    helm.sh/hook: post-delete
    helm.sh/hook-delete-policy: hook-succeeded
    helm.sh/hook-weight: "3"
  labels:
    app: security
    release: istio
  name: istio-cleanup-secrets
  namespace: default
spec:
  template:
    metadata:
      labels:
        app: security
        chart: security
        heritage: Tiller
        release: istio
        version: 1.1.0
      name: istio-cleanup-secrets
    spec:
      containers:
      - command:
        - /bin/bash
        - -c
        - |
          kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" |  while read -r entry; do
            ns=$(echo $entry | awk '{print $1}');
            name=$(echo $entry | awk '{print $2}');
            kubectl delete secret $name -n $ns;
          done
        image: gcr.io/istio-release/kubectl:master-latest-daily
        imagePullPolicy: IfNotPresent
        name: kubectl
      restartPolicy: OnFailure
      serviceAccountName: istio-cleanup-secrets-service-account
