apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    helm.sh/hook: post-delete
    helm.sh/hook-delete-policy: hook-succeeded
    helm.sh/hook-weight: "3"
  labels:
    app: security
    chart: security
    heritage: Tiller
    release: istio
  name: istio-cleanup-secrets-1.1.6
  namespace: istio-system
spec:
  template:
    metadata:
      labels:
        app: security
        chart: security
        heritage: Tiller
        release: istio
      name: istio-cleanup-secrets
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - ppc64le
            weight: 2
          - preference:
              matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - s390x
            weight: 2
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: beta.kubernetes.io/arch
                operator: In
                values:
                - amd64
                - ppc64le
                - s390x
      containers:
      - command:
        - /bin/bash
        - -c
        - |
          kubectl get secret --all-namespaces | grep "istio.io/key-and-cert" |  while read -r entry; do
            ns=$(echo $entry | awk '{print $1}');
            name=$(echo $entry | awk '{print $2}');
            kubectl delete secret $name -n $ns;
          done
        image: docker.io/istio/kubectl:1.1.6
        imagePullPolicy: IfNotPresent
        name: kubectl
      restartPolicy: OnFailure
      serviceAccountName: istio-cleanup-secrets-service-account
