Make object recovery settlement-safe

tests/kind/wp09-phase.yaml.in

@@ -0,0 +1,34 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: @@JOB_NAME@@
+  namespace: nuthatch-testbed
+spec:
+  activeDeadlineSeconds: 300
+  backoffLimit: 0
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      containers:
+        - name: phase
+          image: @@TEST_IMAGE@@
+          imagePullPolicy: Never
+          command: [nuthatch-wp09-phase]
+          envFrom:
+            - configMapRef: {name: @@PROFILE_NAME@@}
+          env:
+            - {name: NUTHATCH_RECOVERY_PHASE, value: "@@PHASE@@"}
+            - {name: NUTHATCH_RECOVERY_GRACE_SEC, value: "1"}
+            - {name: NUTHATCH_OBJECT_REQUEST_TIMEOUT_SEC, value: "2"}
+            - {name: NUTHATCH_JWT_SECRET, value: synthetic-wp09-session-jwt-secret}
+            - {name: NUTHATCH_PUBLIC_BASE_URL, value: "https://wp09.invalid"}
+            - {name: NUTHATCH_OIDC_ISSUER, value: "https://issuer.invalid"}
+            - {name: NUTHATCH_OIDC_CLIENT_ID, value: wp09}
+            - {name: NUTHATCH_OIDC_ADDITIONAL_AUDIENCES, value: ""}
+            - {name: NUTHATCH_OIDC_CLIENT_SECRET, value: synthetic-wp09-oidc-client-secret}
+            - {name: NUTHATCH_OIDC_REDIRECT_URI, value: "https://wp09.invalid/oidc/callback"}
+          resources:
+            requests: {cpu: 100m, memory: 64Mi}
+            limits: {cpu: "2", memory: 256Mi}