apiVersion: apps/v1
kind: Deployment
metadata:
  name: account-provider
spec:
  template:
    spec:
      # ponytail: patch the immutable staging CMK until account-provider accepts cmkArn configuration.
      initContainers:
        - name: patch-runtime-cmk
          image: cp9.local/account-provider:placeholder
          command:
            - /bin/sh
            - -ec
            - |
              source_cmk_arn=arn:aws:kms:us-west-2:385595570414:key/f15101b5-6aed-48bf-9b9a-fc36406efe92
              [ "${#source_cmk_arn}" -eq "${#CP9_SESSION_CMK_ARN}" ] || {
                echo "account-provider CMK ARN replacement must preserve binary length" >&2
                exit 1
              }
              cp /usr/local/bin/account-provider /cp9-hotfix/account-provider
              sed -i "s|${source_cmk_arn}|${CP9_SESSION_CMK_ARN}|g" /cp9-hotfix/account-provider
              grep -aq "${CP9_SESSION_CMK_ARN}" /cp9-hotfix/account-provider
              ! grep -aq "${source_cmk_arn}" /cp9-hotfix/account-provider
          env:
            - name: CP9_SESSION_CMK_ARN
              value: arn:aws:kms:CP9_RUNTIME_REGION:000000000000:key/cp9-session-placeholder
          volumeMounts:
            - name: cp9-hotfix
              mountPath: /cp9-hotfix
      containers:
        - name: account-provider
          command: ["/cp9-hotfix/account-provider"]
          volumeMounts:
            - name: cp9-hotfix
              mountPath: /cp9-hotfix
      volumes:
        - name: cp9-hotfix
          emptyDir: {}