---
apiVersion: batch/v1
kind: Job
metadata:
  name: lego-generate
  namespace: "${NAMESPACE}"
spec:
  backoffLimit: 2
  template:
    spec:
      initContainers:
        - name: lego
          image: boxboat/lego:${LEGO_VERSION}
          args:
            - --accept-tos
            - --email=${EMAIL}
            - --domains=${DOMAIN_1}
            - --domains=${DOMAIN_2}
            - --dns=route53
            - run
          env:
            - name: AWS_REGION
              value: us-east-1
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: lego-aws
                  key: access-key-id
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: lego-aws
                  key: secret-access-key
          volumeMounts:
            - name: lego-nfs
              mountPath: /home/alpine/.lego
      containers:
        - name: kubectl
          image: boxboat/kubectl:${KUBECTL_VERSION}
          command:
            - sh
            - -c
            - >
              kubectl create secret tls "${TLS_SECRET}"
              -n "${NAMESPACE}"
              --cert=.lego/certificates/${CERT_NAME}.crt
              --key=.lego/certificates/${CERT_NAME}.key
              --dry-run
              -o yaml | kubectl apply -f - && \
              kubectl -n "${NAMESPACE}" label secrets "${TLS_SECRET}" ${REPLICATE_LABEL_NAME}="${REPLICATE_LABEL_VALUE}"
          volumeMounts:
            - name: lego-nfs
              mountPath: /home/alpine/.lego
      restartPolicy: Never
      serviceAccountName: lego
      volumes:
        - name: lego-nfs
          persistentVolumeClaim:
            claimName: lego-nfs
