apiVersion: apps/v1
kind: Deployment
metadata:
  name: oidc-token-refresher
  namespace: openshift-pipelines
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: oidc-token-refresher
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: oidc-token-refresher
        deployment: oidc-token-refresher
    spec:
      containers:
      - command:
        - sh
        - -c
        - |
          #!/bin/bash
          set -o pipefail
          while true; do
            JWT_TOKEN=$(curl -sL --location "${OIDC_TOKEN_ENDPOINT}" \
            --header "Content-Type: application/x-www-form-urlencoded" \
            --data-urlencode "grant_type=client_credentials" \
            --data-urlencode "client_id=${OIDC_CLIENT_ID}" \
            --data-urlencode "client_secret=${OIDC_CLIENT_SECRET}" \
            --data-urlencode "scope=openid" | jq -r '.id_token')
            kubectl create secret generic oidc-token --from-literal=id-token=${JWT_TOKEN} --dry-run=client -o yaml | kubectl apply -f-
            sleep 120
          done
        envFrom:
        - secretRef:
            name: oidc-info
        image: quay.io/openshiftdemos/rollouts-terminal-tooling:latest
        imagePullPolicy: Always
        name: oidc-token-refresher
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      serviceAccount: oidc-token-refresher
      serviceAccountName: oidc-token-refresher
      terminationGracePeriodSeconds: 30