---
apiVersion: batch/v1
kind: Job
metadata:
  labels: {{- include "content-deployment.internal.labels" . | nindent 4 }}
  {{- if or .Values.annotations.job }}
  annotations:
  {{- tpl (toYaml .Values.annotations.job) $ | nindent 4 }}
  {{- end }}
  name: {{ include "content-deployment.internal.jobName" . }}
spec:
  completions: 1
  manualSelector: false
  parallelism: 1
  ttlSecondsAfterFinished: {{ mul .Values.ttlDaysAfterFinished 24 60 60 }}
  template:
    metadata:
      labels: {{- include "content-deployment.internal.labels" . | nindent 8 }}
        {{- if or .Values.annotations.job }}
      annotations:
        {{- tpl (toYaml .Values.annotations.job) $ | nindent 8 }}
        {{- end }}
    spec:
      {{- if (include "content-deployment.internal.imagePullSecretName" .) }}
      imagePullSecrets:
        - name: {{ include "content-deployment.internal.imagePullSecretName" . }}
      {{- end }}
      automountServiceAccountToken: false
      serviceAccountName: {{ tpl (.Values.serviceAccountName | default (include "content-deployment.internal.fullname" .)) $ }}
      containers:
      - image: {{ include "content-deployment.internal.imageName" . }}
      {{- if ( or .Values.global.imagePullPolicy .Values.imagePullPolicy ) }}
        imagePullPolicy: {{ .Values.imagePullPolicy |  default .Values.global.imagePullPolicy }}
      {{- end }}
        name: {{ include "content-deployment.internal.name" . }}
        {{- if .Values.command }}
        command:
        {{- toYaml .Values.command | nindent 8 }}
        {{- end }}
        {{- if .Values.args }}
        args:
        {{- toYaml .Values.args | nindent 8 }}
        {{- end }}
        env:
        - name: EXIT
          value: "1"
        - name: EXIT_PROCESS_AFTER_UPLOAD
          value: "true"
        - name: TMPDIR
          value: /tmp
        - name: SERVICE_BINDING_ROOT
          value: /bindings
        {{- $envVars := (include "content-deployment.internal.processEnv" $ | fromJson) }}
        {{- if not (eq (len $envVars.vars) 0) }}
        {{- $envVars.vars | toYaml | nindent 8}}
        {{- end }}
        envFrom:
        {{- $envFromVars := (include "content-deployment.internal.processEnvFrom" . | fromJson) }}
        {{- if not (eq (len $envFromVars.vars) 0) }}
        {{- $envFromVars.vars | toYaml | nindent 8}}
        {{- end }}
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsNonRoot: true
          {{- if .Values.runAsUser }}
          runAsUser: {{ .Values.runAsUser }}
          {{- end }}
          readOnlyRootFilesystem: {{ $.Values.readOnlyRootFilesystem | default false }}
          appArmorProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        {{- include "content-deployment.internal.serviceMounts" . | nindent 8 }}
      restartPolicy: OnFailure
      {{- if .Values.nodeSelector }}
      nodeSelector:
        {{- .Values.nodeSelector | toYaml | nindent 8 }}
      {{- end }}
      {{- if .Values.nodeAffinity }}
      affinity:
        {{- .Values.nodeAffinity | toYaml | nindent 8 }}
      {{- end }}
      volumes:
      - name: tmp
        emptyDir: {}
      {{- include "content-deployment.internal.serviceVolumes" . | nindent 6 }}