apiVersion: batch/v1
kind: Job
metadata:
  name: vault-init
  namespace: vault
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "1"
spec:
  backoffLimit: 3
  template:
    spec:
      serviceAccountName: argocd-hook-sa
      containers:
        - name: vault-init
          image: alpine/k8s:1.32.13
          command: ["/bin/bash", "/scripts/vault-init-and-store.sh"]
          env:
            # See the matching comment in vault-init-configmap.yaml for
            # why this can't come from Vault itself via ESO.
            - name: VAULT_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: vault-oidc-bootstrap
                  key: client_id
            - name: VAULT_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: vault-oidc-bootstrap
                  key: client_secret
          volumeMounts:
            - name: scripts
              mountPath: /scripts
      volumes:
        - name: scripts
          configMap:
            name: vault-init-script
            defaultMode: 0755
      restartPolicy: Never