Merge pull request #469 from kubefirst/feat-ecr-sync

feat: ecr token sync

Author: echoboomer

aws-github/cluster-types/mgmt/components/actions-runner-controller/wait.yaml

@@ -10,15 +10,15 @@ metadata:
   name: k8s-toolkit-arc
   namespace: github-runner
 rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - watch
-  - list
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - watch
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -30,30 +30,30 @@ roleRef:
   kind: Role
   name: k8s-toolkit-arc
 subjects:
-- kind: ServiceAccount
-  name: k8s-toolkit-arc
-  namespace: github-runner
+  - kind: ServiceAccount
+    name: k8s-toolkit-arc
+    namespace: github-runner
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "20"
+    argocd.argoproj.io/sync-wave: '20'
   name: wait-actions-runner-controller
   namespace: github-runner
 spec:
   template:
     spec:
       containers:
-      - args:
-        - wait-for
-        - deployment
-        - --namespace
-        - github-runner
-        - --label
-        - app.kubernetes.io/name=actions-runner-controller
-        image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.7
-        imagePullPolicy: IfNotPresent
-        name: wait
+        - args:
+            - wait-for
+            - deployment
+            - --namespace
+            - github-runner
+            - --label
+            - app.kubernetes.io/name=actions-runner-controller
+          image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+          imagePullPolicy: IfNotPresent
+          name: wait
       restartPolicy: OnFailure
-      serviceAccountName: k8s-toolkit-arc
+      serviceAccountName: k8s-toolkit-arc

aws-github/cluster-types/mgmt/components/argo-workflows/ecr-publish-permissions-sync.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ecr-publish-permissions-sync
+  namespace: argo
+  annotations:
+    eks.amazonaws.com/role-arn: 'arn:aws:iam::<AWS_ACCOUNT_ID>:role/ecr-publish-permissions-sync-<CLUSTER_NAME>'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ecr-publish-permissions-sync
+  namespace: argo
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - watch
+      - list
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+      - watch
+      - list
+      - update
+      - create
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ecr-publish-permissions-sync
+  namespace: argo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ecr-publish-permissions-sync
+subjects:
+  - kind: ServiceAccount
+    name: ecr-publish-permissions-sync
+    namespace: argo
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: '20'
+  name: ecr-publish-permissions-sync
+  namespace: argo
+spec:
+  # Run every 6 hours.
+  schedule: '0 */6 * * *'
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: ecr-publish-permissions-sync
+          restartPolicy: OnFailure
+          containers:
+            - name: ecr-publish-permissions-sync
+              image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+              imagePullPolicy: IfNotPresent
+              args:
+                - sync-ecr-token
+                - --namespace
+                - argo
+                - --region
+                - <CLOUD_REGION>
+                - --registry-url
+                - <CONTAINER_REGISTRY_URL>

aws-github/cluster-types/mgmt/components/argo-workflows/wait.yaml

@@ -10,15 +10,15 @@ metadata:
   name: k8s-toolkit-argo
   namespace: argo
 rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - watch
-  - list
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - watch
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -30,55 +30,55 @@ roleRef:
   kind: Role
   name: k8s-toolkit-argo
 subjects:
-- kind: ServiceAccount
-  name: k8s-toolkit-argo
-  namespace: argo
+  - kind: ServiceAccount
+    name: k8s-toolkit-argo
+    namespace: argo
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "20"
+    argocd.argoproj.io/sync-wave: '20'
   name: wait-argo-workflow-controller
   namespace: argo
 spec:
   template:
     spec:
       containers:
-      - args:
-        - wait-for
-        - deployment
-        - --namespace
-        - argo
-        - --label
-        - app.kubernetes.io/name=argo-workflow-controller
-        image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.7
-        imagePullPolicy: IfNotPresent
-        name: wait
+        - args:
+            - wait-for
+            - deployment
+            - --namespace
+            - argo
+            - --label
+            - app.kubernetes.io/name=argo-workflow-controller
+          image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+          imagePullPolicy: IfNotPresent
+          name: wait
       restartPolicy: OnFailure
       serviceAccountName: k8s-toolkit-argo
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "20"
+    argocd.argoproj.io/sync-wave: '20'
   name: wait-argo-server
   namespace: argo
 spec:
   backoffLimit: 10
   template:
     spec:
       containers:
-      - args:
-        - wait-for
-        - deployment
-        - --namespace
-        - argo
-        - --label
-        - app.kubernetes.io/name=argo-server
-        image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.7
-        imagePullPolicy: IfNotPresent
-        name: wait
+        - args:
+            - wait-for
+            - deployment
+            - --namespace
+            - argo
+            - --label
+            - app.kubernetes.io/name=argo-server
+          image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+          imagePullPolicy: IfNotPresent
+          name: wait
       restartPolicy: OnFailure
       serviceAccountName: k8s-toolkit-argo

aws-github/cluster-types/mgmt/components/atlantis/wait.yaml

@@ -10,15 +10,15 @@ metadata:
   name: k8s-toolkit-atlantis
   namespace: atlantis
 rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - watch
-  - list
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - watch
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -30,30 +30,30 @@ roleRef:
   kind: Role
   name: k8s-toolkit-atlantis
 subjects:
-- kind: ServiceAccount
-  name: k8s-toolkit-atlantis
-  namespace: atlantis
+  - kind: ServiceAccount
+    name: k8s-toolkit-atlantis
+    namespace: atlantis
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "20"
+    argocd.argoproj.io/sync-wave: '20'
   name: wait-atlantis
   namespace: atlantis
 spec:
   template:
     spec:
       containers:
-      - args:
-        - wait-for
-        - statefulset
-        - --namespace
-        - atlantis
-        - --label
-        - app=atlantis
-        image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.7
-        imagePullPolicy: IfNotPresent
-        name: wait
+        - args:
+            - wait-for
+            - statefulset
+            - --namespace
+            - atlantis
+            - --label
+            - app=atlantis
+          image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+          imagePullPolicy: IfNotPresent
+          name: wait
       restartPolicy: OnFailure
       serviceAccountName: k8s-toolkit-atlantis

aws-github/cluster-types/mgmt/components/chartmuseum/wait.yaml

@@ -10,15 +10,15 @@ metadata:
   name: k8s-toolkit-chartmuseum
   namespace: chartmuseum
 rules:
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - watch
-  - list
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - watch
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -30,30 +30,30 @@ roleRef:
   kind: Role
   name: k8s-toolkit-chartmuseum
 subjects:
-- kind: ServiceAccount
-  name: k8s-toolkit-chartmuseum
-  namespace: chartmuseum
+  - kind: ServiceAccount
+    name: k8s-toolkit-chartmuseum
+    namespace: chartmuseum
 ---
 apiVersion: batch/v1
 kind: Job
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "20"
+    argocd.argoproj.io/sync-wave: '20'
   name: wait-chartmuseum
   namespace: chartmuseum
 spec:
   template:
     spec:
       containers:
-      - args:
-        - wait-for
-        - deployment
-        - --namespace
-        - chartmuseum
-        - --label
-        - app.kubernetes.io/name=chartmuseum
-        image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.7
-        imagePullPolicy: IfNotPresent
-        name: wait
+        - args:
+            - wait-for
+            - deployment
+            - --namespace
+            - chartmuseum
+            - --label
+            - app.kubernetes.io/name=chartmuseum
+          image: public.ecr.aws/kubefirst/kubernetes-toolkit:0.0.8
+          imagePullPolicy: IfNotPresent
+          name: wait
       restartPolicy: OnFailure
-      serviceAccountName: k8s-toolkit-chartmuseum
+      serviceAccountName: k8s-toolkit-chartmuseum