56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: oidc-token-refresher
|
|
namespace: openshift-pipelines
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: oidc-token-refresher
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
app: oidc-token-refresher
|
|
deployment: oidc-token-refresher
|
|
spec:
|
|
containers:
|
|
- command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
#!/bin/bash
|
|
set -o pipefail
|
|
while true; do
|
|
JWT_TOKEN=$(curl -sL --location "${OIDC_TOKEN_ENDPOINT}" \
|
|
--header "Content-Type: application/x-www-form-urlencoded" \
|
|
--data-urlencode "grant_type=client_credentials" \
|
|
--data-urlencode "client_id=${OIDC_CLIENT_ID}" \
|
|
--data-urlencode "client_secret=${OIDC_CLIENT_SECRET}" \
|
|
--data-urlencode "scope=openid" | jq -r '.id_token')
|
|
kubectl create secret generic oidc-token --from-literal=id-token=${JWT_TOKEN} --dry-run=client -o yaml | kubectl apply -f-
|
|
sleep 120
|
|
done
|
|
envFrom:
|
|
- secretRef:
|
|
name: oidc-info
|
|
image: quay.io/openshiftdemos/rollouts-terminal-tooling:latest
|
|
imagePullPolicy: Always
|
|
name: oidc-token-refresher
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
serviceAccount: oidc-token-refresher
|
|
serviceAccountName: oidc-token-refresher
|
|
terminationGracePeriodSeconds: 30
|