# RPF-WP-0046: daily renew-self for the ESO parent tokens of the five
# dynamic-database ClusterSecretStores. The Secrets are mounted, not read via
# the API, so the ServiceAccount has no RBAC and no API token.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: eso-token-renewer
  namespace: external-secrets
  labels:
    app.kubernetes.io/name: eso-token-renewer
    app.kubernetes.io/part-of: railiance-platform
automountServiceAccountToken: false
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: eso-token-renewer
  namespace: external-secrets
  labels:
    app.kubernetes.io/name: eso-token-renewer
    app.kubernetes.io/part-of: railiance-platform
spec:
  schedule: '40 2 * * *'
  timeZone: Etc/UTC
  suspend: false
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 3600
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  jobTemplate:
    spec:
      activeDeadlineSeconds: 300
      backoffLimit: 2
      ttlSecondsAfterFinished: 604800
      template:
        metadata:
          labels:
            app.kubernetes.io/name: eso-token-renewer
        spec:
          serviceAccountName: eso-token-renewer
          automountServiceAccountToken: false
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            fsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
          - name: renew
            image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
            command: [python3, /worker/renew.py]
            env:
            - name: PYTHONDONTWRITEBYTECODE
              value: '1'
            - name: BAO_ADDR
              value: http://openbao.openbao.svc:8200
            - name: ESO_TOKEN_ROOT
              value: /var/run/eso-tokens
            - name: MIN_TTL_SECONDS
              value: '259200'
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities:
                drop: [ALL]
            resources:
              requests: {cpu: 10m, memory: 24Mi}
              limits: {cpu: 100m, memory: 64Mi}
            volumeMounts:
            - {name: worker, mountPath: /worker, readOnly: true}
            - {name: audit-core, mountPath: /var/run/eso-tokens/audit-core, readOnly: true}
            - {name: canned-prompts, mountPath: /var/run/eso-tokens/canned-prompts, readOnly: true}
            - {name: core-hub, mountPath: /var/run/eso-tokens/core-hub, readOnly: true}
            - {name: sbom-nexus, mountPath: /var/run/eso-tokens/sbom-nexus, readOnly: true}
            - {name: tenant-engine, mountPath: /var/run/eso-tokens/tenant-engine, readOnly: true}
          volumes:
          - name: worker
            configMap: {name: eso-token-renewer-worker, defaultMode: 0444}
          - name: audit-core
            secret: {secretName: openbao-audit-core-eso-token, defaultMode: 0440, items: [{key: token, path: token}]}
          - name: canned-prompts
            secret: {secretName: openbao-canned-prompts-eso-token, defaultMode: 0440, items: [{key: token, path: token}]}
          - name: core-hub
            secret: {secretName: openbao-core-hub-eso-token, defaultMode: 0440, items: [{key: token, path: token}]}
          - name: sbom-nexus
            secret: {secretName: openbao-sbom-nexus-eso-token, defaultMode: 0440, items: [{key: token, path: token}]}
          - name: tenant-engine
            secret: {secretName: openbao-tenant-engine-eso-token, defaultMode: 0440, items: [{key: token, path: token}]}