Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/acs-tokens/base/postsync-create-roxsecrets-job.yaml

@@ -0,0 +1,85 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: postsync-create-roxsecrets-job
+  namespace: stackrox
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  template:
+    spec:
+      containers:
+        - image: quay.io/gnunn/tools:4.10-1
+          env:
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: central-htpasswd
+          envFrom:
+          - configMapRef:
+              name: roxsecret-namespaces
+          command:
+          - /bin/bash
+          - -c
+          - |
+            # Wait for central to be ready
+            attempt_counter=0
+            max_attempts=20
+            echo "Waiting for central to be available..."
+            until $(curl -k --output /dev/null --silent --head --fail https://$CENTRAL_URL); do
+              if [ ${attempt_counter} -eq ${max_attempts} ];then
+                echo "Max attempts reached"
+                exit 1
+              fi
+              printf '.'
+              attempt_counter=$(($attempt_counter+1))
+              echo "Made attempt $attempt_counter, waiting..."
+              sleep 10
+            done
+
+            API_ENDPOINT="/v1/apitokens/generate"
+            CENTRAL_URL_API="https://$CENTRAL_URL$API_ENDPOINT"
+            echo "Central API endpoint: $CENTRAL_URL_API"
+            echo "Creating secrets in namespaces $NAMESPACES"
+
+            for NAMESPACE in ${NAMESPACES//,/ }
+            do
+              echo "Creating secret for $NAMESPACE"
+              if [[ `oc get namespace $NAMESPACE 2>/dev/null` ]] ;
+              then
+                  echo "Namespace '$NAMESPACE' exists, checking secret..."
+              else
+                  echo "Namespace '$NAMESPACE' doesn't exist, skipping"
+                  continue
+              fi
+
+              # If secret already exists, don't regenerate.
+              if [[ -n `oc get secret roxsecrets -n $NAMESPACE 2>/dev/null` ]] ;
+              then
+                  echo "Stackrox token secret already exists in $NAMESPACE"
+                  continue
+              fi
+              PAYLOAD="{\"name\": \"$NAMESPACE\", \"role\": \"Continuous Integration\"}"
+              echo "$PAYLOAD"
+              echo "Generate new token."
+              RESPONSE=$(curl -k \
+                -X POST -u "admin:$PASSWORD" \
+                -H "Content-Type: application/json" \
+                --data "$PAYLOAD" \
+                $CENTRAL_URL_API)
+              TOKEN=$(jq -r '.token' <<< "$RESPONSE")
+
+              # Create secret in target namespace
+              oc create secret generic roxsecrets \
+                --from-literal=rox_central_endpoint=$CENTRAL_URL:443 \
+                --from-literal=rox_api_token=$TOKEN \
+                -n $NAMESPACE
+            done
+          name: create-secrets
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      terminationGracePeriodSeconds: 30
+      serviceAccount: postsync-create-roxsecrets
+      serviceAccountName: postsync-create-roxsecrets