apiVersion: batch/v1
kind: Job
metadata:
  name: ${APP_NAME}-client-cert-init-for-user
  namespace: ${NAMESPACE}
  labels:
    app: ${APP_NAME}-client
spec:
  template:
    metadata:
      labels:
        app: ${APP_NAME}-client
    spec:
      serviceAccountName: ${APP_NAME}
      # The init-certs container sends a certificate signing request to the
      # kubernetes cluster.
      # You can see pending requests using: kubectl get csr
      # CSRs can be approved using:         kubectl certificate approve <csr name>
      #
      # In addition to the client certificate and key, the init-certs entrypoint will symlink
      # the cluster CA to the certs directory.
      containers:
      - name: init-certs
        image: cockroachdb/cockroach-k8s-request-cert:latest
        imagePullPolicy: IfNotPresent
        command:
          - /bin/ash
          - -ecx
          - >-
            /request-cert
            -namespace=${POD_NAMESPACE}
            -certs-dir=/cockroach-certs/
            -symlink-ca-from=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
            -type=client
            -user=${USER}
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        volumeMounts:
          - name: certs
            mountPath: /cockroach-certs/
      restartPolicy: OnFailure
      volumes:
      - name: certs
        emptyDir: {}