Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/tenant-secrets/base/copy-secrets-cronjob.yaml

@@ -0,0 +1,25 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: copy-secrets
+spec:
+  schedule: "*/2 * * * *"
+  concurrencyPolicy: "Forbid"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: copy-secrets
+          containers:
+          - name: copy-secrets
+            image: quay.io/gnunn/tools:latest
+            imagePullPolicy: Always
+            command:
+            - /bin/bash
+            - -c
+            - |
+              secrets=$(oc get secrets -l replicate=true --no-headers -o custom-columns=":metadata.name")
+              while IFS= read -r secret; do
+                oc get secret $secret -o yaml | oc neat | sed "s/namespace: tenant-secrets/namespace: ${secret}/g" | oc apply -f -
+              done <<< "$secrets"
+          restartPolicy: OnFailure

components/tenant-secrets/base/copy-secrets-rbac.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: copy-secrets
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: copy-secrets
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: copy-secrets
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: copy-secrets
+subjects:
+  - kind: ServiceAccount
+    name: copy-secrets
+    namespace: tenant-secrets

components/tenant-secrets/base/kustomization.yaml

@@ -0,0 +1,6 @@
+namespace: tenant-secrets
+
+resources:
+- copy-secrets-rbac.yaml
+- copy-secrets-cronjob.yaml
+- namespace.yaml

components/tenant-secrets/base/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    openshift.io/description: "manage Tenant Secrets"
+  name: tenant-secrets