Refresh K8s secret for ECR to pull the private image from AWS

k8s-aws-ecr-secret-refresh-cronjob.yaml

apiVersion: v1
kind: Secret
metadata:
  name: ecr-registry-secrets
stringData:
  AWS_SECRET_ACCESS_KEY: "rgsssdfasdf"
  AWS_ACCESS_KEY_ID: "AFIK"
  AWS_ACCOUNT: "12345"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ecr-registry-cm
data:
  AWS_REGION: "eu-west-1"
  DOCKER_SECRET_NAME: eu-west-1-ecr-registry
  EMAIL: [email protected]
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ecr-secret-refresh
spec:
  schedule: "0 */10 * * *"
  successfulJobsHistoryLimit: 3
  suspend: false
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: sa-ecr-registry-refresh
          containers:
          - name: ecr-registry-token
            image: odaniait/aws-kubectl:latest
            imagePullPolicy: IfNotPresent
            envFrom:
              - secretRef:
                  name: ecr-registry-secrets
              - configMapRef:
                  name: ecr-registry-cm
            command:
              - /bin/sh
              - -c
              - |-
                ECR_TOKEN=`aws ecr --region=$AWS_REGION get-authorization-token --output text --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2`
                NAMESPACE_NAME=default
                kubectl delete secret --ignore-not-found $DOCKER_SECRET_NAME -n $NAMESPACE_NAME
                kubectl create secret docker-registry $DOCKER_SECRET_NAME \
                --docker-server=https://${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com \
                --docker-username=AWS \
                --docker-password="${ECR_TOKEN}" \
                --docker-email="${EMAIL}" \
                --namespace=$NAMESPACE_NAME
                echo "Secret was successfully updated at $(date)"
          restartPolicy: Never
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-ecr-registry-refresh
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secrets-create-delete
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["eu-west-1-ecr-registry"]
  verbs: ["delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ecr-registry-helper-role-binding
subjects:
- kind: ServiceAccount
  name: sa-ecr-registry-refresh
  apiGroup: ""
roleRef:
  kind: Role
  name: secrets-create-delete
  apiGroup: ""
---