apiVersion: batch/v1
kind: CronJob
metadata:
  name: ca-sync
  namespace: vault
spec:
  schedule: "*/15 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 120
      template:
        metadata:
          labels:
            app.kubernetes.io/name: ca-sync
            app.kubernetes.io/instance: ca-sync
        spec:
          restartPolicy: Never
          serviceAccountName: ca-sync
          imagePullSecrets:
            - name: ca-sync-pull
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: sync
              image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
              command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
              args:
                - /source/run.fsx
                - pki=ca/internal
                - pki_postgres=ca/postgres
                - pki_opnsense=ca/opnsense
              env:
                - name: VAULT_ADDR
                  value: https://vault.vault.svc.cluster.local:8200
                - name: VAULT_ROLE
                  value: ca-sync
                - name: VAULT_MOUNT
                  value: secret
                - name: JWT_PATH
                  value: /var/run/secrets/kubernetes.io/serviceaccount/token
                - name: HOME
                  value: /tmp
                - name: SSL_CERT_FILE
                  value: /ca/ca.crt
                - name: DOTNET_NOLOGO
                  value: "true"
                - name: DOTNET_CLI_TELEMETRY_OPTOUT
                  value: "1"
              resources:
                requests:
                  cpu: 50m
                  memory: 128Mi
                limits:
                  memory: 512Mi
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: [ALL]
              volumeMounts:
                - name: source
                  mountPath: /source
                  readOnly: true
                - name: ca
                  mountPath: /ca
                  readOnly: true
                - name: tmp
                  mountPath: /tmp
          volumes:
            - name: source
              configMap:
                name: ca-sync
            - name: ca
              secret:
                secretName: ca-sync-root
                items:
                  - key: ca.crt
                    path: ca.crt
            - name: tmp
              emptyDir: {}