[MOSIP-23969]

charts/regclient/templates/keystorejob.yaml

@@ -0,0 +1,38 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Values.job.name }}-{{ .Release.Namespace }}"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{.Release.Service | quote }}
+    app.kubernetes.io/instance: {{.Release.Name | quote }}
+    helm.sh/chart: "{{.Chart.Name}}-{{.Chart.Version}}"
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-2" # The Job will execute after the RoleBinding.
+spec:
+  template:
+    metadata:
+      name: "{{.Release.Name}}"
+      namespace: {{ .Release.Namespace }}
+      labels:
+        app.kubernetes.io/managed-by: {{.Release.Service | quote }}
+        app.kubernetes.io/instance: {{.Release.Name | quote }}
+        helm.sh/chart: "{{.Chart.Name}}-{{.Chart.Version}}"
+        sidecar.istio.io/inject: "false"
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ template "regclient.serviceAccountName" . }}
+      containers:
+      - name: openssl-container
+        image: "{{ .Values.job.image }}:{{ .Values.job.tag }}"
+        imagePullPolicy: {{ .Values.job.pullPolicy }}
+        env:
+        - name: NAMESPACE
+          value: "{{ .Release.Namespace }}"
+        volumeMounts:
+        - name: certs-volume
+          mountPath: /home/mosip/certs
+      volumes:
+      - name: certs-volume
+        emptyDir: {}

charts/regclient/templates/keystorerole.yaml

@@ -0,0 +1,12 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: "{{ .Values.job.rolename }}-{{ .Release.Namespace }}"
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-4" #The Role will execute after the ServiceAccount
+rules:
+  - apiGroups: [""]
+    resources: ["pods","configmaps", "secrets"]
+    verbs: ["create", "delete", "patch"]

charts/regclient/templates/keystorerolebinding.yaml

@@ -0,0 +1,16 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: "{{ .Values.job.rolebindingname }}-{{ .Release.Namespace }}"
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-3" # The RoleBinding will execute after the Role
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "regclient.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Values.job.rolename }}-{{ .Release.Namespace }}"
+  apiGroup: rbac.authorization.k8s.io

charts/regclient/templates/service-account.yaml → charts/regclient/templates/serviceaccount.yaml

@@ -9,4 +9,7 @@ metadata:
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-5" # The hook-weight is used to order hooks; lower weights run first.The ServiceAccount will execute first due to the lowest weight.
   namespace: {{ .Release.Namespace }}

charts/regclient/values.yaml

@@ -64,6 +64,15 @@ image:
   ##
   # pullSecrets:
   #   - myRegistryKeySecretName
+# Configuration for the keystoreJob
+job:
+  name: keystorejob
+  registry: docker.io
+  image: mosipdev/regclient-keystore
+  tag: develop
+  pullPolicy: Always
+  rolename: keystorerole
+  rolebindingname: keystorerolebinding
 
 regclient:
   version: 1.2.1-SNAPSHOT