apiVersion: batch/v1
kind: Job
metadata:
  name: seed
  namespace: short
  annotations:
    kustomize.toolkit.fluxcd.io/force: Enabled
spec:
  completions: 2
  parallelism: 2
  template:
    metadata:
      labels:
        app.kubernetes.io/name: seed
        app.kubernetes.io/instance: short
    spec:
      serviceAccountName: short-seed
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: seed
        image: short-image
        args:
        - seed
        env:
        - name: VAULT_ADDR
          value: https://vault.vault.svc.cluster.local:8200
        - name: SSL_CERT_FILE
          value: /ca/ca.crt
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        resources:
          requests:
            cpu: 50m
            memory: 32Mi
          limits:
            memory: 128Mi
        volumeMounts:
        - name: ca
          mountPath: /ca
          readOnly: true
      volumes:
      - name: ca
        secret:
          secretName: ca