Kubernetes CronJob to keep AWS Registry pull credentials fresh

aws-registry-credential-cron.yml

apiVersion: batch/v2alpha1
kind: CronJob
metadata:
  name: aws-registry-credential-cron
spec:
  schedule: "* */8 * * *"
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 2  
  jobTemplate:
    spec:
      backoffLimit: 4
      template:
        spec:
          serviceAccountName: <XXXXXXXXXXX-SERVICE-ACCCOUNT-THAT-CAN-DELETE-AND-UPDATE-SECRETS>
          terminationGracePeriodSeconds: 0
          restartPolicy: Never
          containers:
          - name: kubectl
            imagePullPolicy: IfNotPresent
            image: xynova/aws-kubectl:latest
            command:
            - "/bin/sh"
            - "-c"
            - |
              AWS_ACCOUNT=<XXXXXXXXXXX-AWS-ACCOUNT-ID>
              AWS_REGION=ap-southeast-2
              DOCKER_REGISTRY_SERVER=https://${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com
              DOCKER_USER=AWS
              DOCKER_PASSWORD=`aws ecr get-login --region ${AWS_REGION} --registry-ids ${AWS_ACCOUNT} | cut -d' ' -f6`

              kubectl delete secret aws-registry || true
              kubectl create secret docker-registry aws-registry \
              --docker-server=$DOCKER_REGISTRY_SERVER \
              --docker-username=$DOCKER_USER \
              --docker-password=$DOCKER_PASSWORD \
              --docker-email=no@email.local

              kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"aws-registry"}]}'