apiVersion: batch/v1
kind: CronJob
metadata:
  name: copy-secrets
spec:
  schedule: "*/2 * * * *"
  concurrencyPolicy: "Forbid"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: copy-secrets
          containers:
          - name: copy-secrets
            image: quay.io/gnunn/tools:latest
            imagePullPolicy: Always
            command:
            - /bin/bash
            - -c
            - |
              secrets=$(oc get secrets -l replicate=true --no-headers -o custom-columns=":metadata.name")
              while IFS= read -r secret; do
                oc get secret $secret -o yaml | oc neat | sed "s/namespace: tenant-secrets/namespace: ${secret}/g" | oc apply -f -
              done <<< "$secrets"
          restartPolicy: OnFailure