Kubernetes Cronjob to set PV's reclaim policy to Retain

reclaim-policy.yaml

kind: ServiceAccount
apiVersion: v1
metadata:
  name: reclaim-policy
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: reclaim-policy
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: reclaim-policy
subjects:
- kind: ServiceAccount
  name: reclaim-policy
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: reclaim-policy
rules:
- apiGroups:
  - ""
  resources:
  - persistentvolumes
  verbs:
  - get
  - list
  - patch
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: reclaim-policy-scripts
  namespace: monitoring
data:
  set-to-retain.sh: |
    #!/bin/bash
    # See https://kubernetes.io/docs/tasks/administer-cluster/change-pv-reclaim-policy/

    echo ">>> BEFORE"
    kubectl get pv

    kubectl patch pv $(kubectl get pv -o json | jq -r '.items[] | select(.spec .persistentVolumeReclaimPolicy != "Retain") | .metadata .name')  -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'

    echo ">>> AFTER"
    kubectl get pv

---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: reclaim-policy
  namespace: monitoring
  labels:
    app: reclaim-policy
spec:
  schedule: "@hourly"
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: reclaim-policy
        spec:
          serviceAccount: reclaim-policy
          containers:
          - name: reclaim-policy
            image: solsson/kafka-initutils@sha256:18bf01c2c756b550103a99b3c14f741acccea106072cd37155c6d24be4edd6e2
            args:
            - /bin/bash
            - -c
            - "/scripts/set-to-retain.sh"
            volumeMounts:
            - name: scripts-d
              mountPath: /scripts
          volumes:
          - name: scripts-d
            projected:
              defaultMode: 500
              sources:
              - configMap:
                  name: reclaim-policy-scripts
                  items:
                  - key: set-to-retain.sh
                    path: set-to-retain.sh
          restartPolicy: Never
  successfulJobsHistoryLimit: 10
  failedJobsHistoryLimit: 10