From d0509c7067920db3b1cd21711625e09168a4fc22 Mon Sep 17 00:00:00 2001
From: "Mike Ray (SQL)" <mikeray@microsoft.com>
Date: Mon, 24 Sep 2018 10:17:18 -0700
Subject: [PATCH] Add rotate-creds

---
 .../sample-manifest-files/rotate-creds.yaml   | 94 +++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 samples/features/high availability/Kubernetes/sample-manifest-files/rotate-creds.yaml

diff --git a/samples/features/high availability/Kubernetes/sample-manifest-files/rotate-creds.yaml b/samples/features/high availability/Kubernetes/sample-manifest-files/rotate-creds.yaml
new file mode 100644
index 00000000..7a2a5b54
--- /dev/null
+++ b/samples/features/high availability/Kubernetes/sample-manifest-files/rotate-creds.yaml	
@@ -0,0 +1,94 @@
+#kubectl create secret generic new-sql-secrets --from-literal='sapassword=Yukon800' --from-literal='masterkeypassword=Yukon800'
+
+---
+apiVersion: v1
+
+kind: ServiceAccount
+
+metadata:
+  name: rotate-creds
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+
+kind: Role
+
+metadata:
+  name: rotate-creds
+
+rules:
+- resources: ["secrets"]
+  apiGroups: [""]
+  verbs: ["get", "update"]
+- resources: ["pods"]
+  apiGroups: [""]
+  verbs: ["list"]
+- resources: ["statefulsets"]
+  apiGroups: ["apps"]
+  verbs: ["get"]
+
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+
+kind: RoleBinding
+
+metadata:
+  name: rotate-creds
+  namespace: default
+
+roleRef:
+  name: rotate-creds
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+
+subjects:
+- name: rotate-creds
+  kind: ServiceAccount
+
+
+---
+apiVersion: batch/v1
+
+kind: Job
+
+metadata:
+  name: rotate-creds
+
+spec:
+  template:
+    metadata:
+      name: rotate-creds
+    spec:
+      serviceAccount: rotate-creds
+      restartPolicy: Never
+      containers:
+      - name: rotate-creds
+        image: mssql-server-k8s-agents:20.22 # TODO: update
+        command: ["/mssql-server-k8s-rotate-creds"]
+        env:
+        - name: MSSQL_K8S_STATEFULSET_NAME
+          value: sql-0
+        - name: MSSQL_ROTATE_CERT
+          value: "True"
+        - name: MSSQL_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: MSSQL_K8S_MASTER_KEY_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: new-sql-secrets
+              key: masterkeypassword
+        - name: MSSQL_K8S_SA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: sql-secrets
+              key: sapassword
+        - name: MSSQL_K8S_NEW_SA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: new-sql-secrets
+              key: sapassword
+        
+