Add rotate-creds

2025-12-08 14:58:54 +00:00 · 2018-09-24 10:17:18 -07:00
parent 2613bacacf
commit d0509c7067
1 changed files with 94 additions and 0 deletions
@@ -0,0 +1,94 @@
+#kubectl create secret generic new-sql-secrets --from-literal='sapassword=Yukon800' --from-literal='masterkeypassword=Yukon800'
+
+---
+apiVersion: v1
+
+kind: ServiceAccount
+
+metadata:
+  name: rotate-creds
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+
+kind: Role
+
+metadata:
+  name: rotate-creds
+
+rules:
+- resources: ["secrets"]
+  apiGroups: [""]
+  verbs: ["get", "update"]
+- resources: ["pods"]
+  apiGroups: [""]
+  verbs: ["list"]
+- resources: ["statefulsets"]
+  apiGroups: ["apps"]
+  verbs: ["get"]
+
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+
+kind: RoleBinding
+
+metadata:
+  name: rotate-creds
+  namespace: default
+
+roleRef:
+  name: rotate-creds
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+
+subjects:
+- name: rotate-creds
+  kind: ServiceAccount
+
+
+---
+apiVersion: batch/v1
+
+kind: Job
+
+metadata:
+  name: rotate-creds
+
+spec:
+  template:
+    metadata:
+      name: rotate-creds
+    spec:
+      serviceAccount: rotate-creds
+      restartPolicy: Never
+      containers:
+      - name: rotate-creds
+        image: mssql-server-k8s-agents:20.22 # TODO: update
+        command: ["/mssql-server-k8s-rotate-creds"]
+        env:
+        - name: MSSQL_K8S_STATEFULSET_NAME
+          value: sql-0
+        - name: MSSQL_ROTATE_CERT
+          value: "True"
+        - name: MSSQL_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: MSSQL_K8S_MASTER_KEY_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: new-sql-secrets
+              key: masterkeypassword
+        - name: MSSQL_K8S_SA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: sql-secrets
+              key: sapassword
+        - name: MSSQL_K8S_NEW_SA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: new-sql-secrets
+              key: sapassword
+        
+