---
apiVersion: batch/v1
kind: Job
metadata:
  name: createcerts
  namespace: fulcio-system
spec:
  template:
    spec:
      serviceAccountName: createcerts
      restartPolicy: Never
      automountServiceAccountToken: true
      containers:
      - name: createcerts
        image: ko://github.com/sigstore/scaffolding/cmd/fulcio/createcerts
        args: [
          "--secret=fulcio-secret"
        ]
        env:
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
