Argocd Image Updater Part-II

kubectl create secret docker-registry mycontainerregistry-secret \
  --docker-server=acc_id.dkr.ecr.ap-southeast-1.amazonaws.com \
  --docker-username=AWS \
  --docker-password=$(aws ecr get-login-password --region ap-southeast-1) \
  --namespace=argocd

apiVersion: v1
data:
  log.level: debug
  registries.conf: |
    registries:
    - name: AWS ECR
      prefix: acc_id.dkr.ecr.ap-southeast-1.amazonaws.com
      api_url: https://acc_id.dkr.ecr.ap-southeast-1.amazonaws.com
      credentials: pullsecret:argocd/mycontainerregistry-secret
      ping: yes
      default: true
      insecure: no
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-image-updater-config
    app.kubernetes.io/part-of: argocd-image-updater
  name: argocd-image-updater-config
  namespace: argocd

apiVersion: v1
kind: ServiceAccount
metadata:
  name: argocd-image-updater-ecr-token-refresh-sa
  namespace: argocd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argocd-image-updater-ecr-token-refresh
rules:
- apiGroups: [""]
  resources: ["secrets","pods","configmaps"]
  verbs: ["get", "delete", "list", "watch", "create"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "delete", "list", "watch", "create", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-image-updater-ecr-token-refresh-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argocd-image-updater-ecr-token-refresh
subjects:
- kind: ServiceAccount
  name: argocd-image-updater-ecr-token-refresh-sa
  namespace: argocd
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: argocd-image-updater-ecr-token-refresh
  namespace: argocd
spec:
  schedule: "0 */6 * * *" # Schedule to run every 1 hour
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: argocd-image-updater-ecr-token-refresh-sa
          containers:
          - name: kubectl
            image: acc_id.dkr.ecr.ap-southeast-1.amazonaws.com/kubectl-awscli:latest
            command:
              - "/bin/sh"
              - "-c"
            args:
              - |
                export AWS_ACCESS_KEY_ID=********
                export AWS_SECRET_ACCESS_KEY=********
                export AWS_DEFAULT_REGION=ap-southeast-1

                kubectl delete secret mycontainerregistry-secret -n argocd
                ecr_token=$(aws ecr get-login-password --region ap-southeast-1)

                kubectl create secret docker-registry mycontainerregistry-secret \
                --docker-server=acc_id.dkr.ecr.ap-southeast-1.amazonaws.com \
                --docker-username=AWS \
                --docker-password=$ecr_token \
                --namespace=argocd

                kubectl delete cm argocd-image-updater-config -n argocd
                kubectl apply -f - <<EOF
                apiVersion: v1
                data:
                  log.level: debug
                  registries.conf: |
                    registries:
                    - name: AWS ECR
                      prefix: acc_id.dkr.ecr.ap-southeast-1.amazonaws.com
                      api_url: https://acc_id.dkr.ecr.ap-southeast-1.amazonaws.com
                      credentials: pullsecret:argocd/mycontainerregistry-secret
                      ping: yes
                      default: true
                      insecure: no
                kind: ConfigMap
                metadata:
                  labels:
                    app.kubernetes.io/name: argocd-image-updater-config
                    app.kubernetes.io/part-of: argocd-image-updater
                  name: argocd-image-updater-config
                  namespace: argocd
                EOF

                kubectl delete pods -l app.kubernetes.io/name=argocd-image-updater -n argocd
          restartPolicy: OnFailure