apiVersion: batch/v1
kind: Job
metadata:
  name: mirror-bootstrap
  namespace: mirrored-image
  annotations:
    kustomize.toolkit.fluxcd.io/force: Enabled
  labels:
    app.kubernetes.io/name: mirror-bootstrap
    app.kubernetes.io/instance: mirrored-image
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/name: mirror-bootstrap
        app.kubernetes.io/instance: mirrored-image
    spec:
      serviceAccountName: mirror-bootstrap
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: bootstrap
          image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
          command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
          args: [/bootstrap/bootstrap.fsx]
          env:
            - {name: VAULT_ADDR, value: https://vault.vault.svc.cluster.local:8200}
            - {name: VAULT_ROLE, value: mirror-bootstrap}
            - {name: JWT_PATH, value: /var/run/secrets/kubernetes.io/serviceaccount/token}
            - {name: CA_PATH, value: /registry-ca/ca.crt}
            - {name: QUAY_URL, value: https://registry.quorate.internal}
            - {name: ZITADEL_API, value: http://zitadel.zitadel.svc.cluster.local:8080}
            - {name: ZITADEL_ISSUER, value: https://auth.quorate.dev}
            - {name: KUBE_URL, value: https://kubernetes.default.svc}
            - {name: KUBE_CA, value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt}
            - {name: LOGIN_NAMESPACE, value: zitadel}
            - {name: LOGIN_SECRET, value: zitadel-login-service-key}
            - {name: ADMIN_PATH, value: secret/data/quay/bootstrap}
          resources:
            requests: {cpu: 50m, memory: 64Mi}
            limits: {cpu: 500m, memory: 256Mi}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
            readOnlyRootFilesystem: true
          volumeMounts:
            - {name: scripts, mountPath: /bootstrap, readOnly: true}
            - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
            - {name: temporary, mountPath: /tmp}
      volumes:
        - {name: scripts, configMap: {name: mirror-bootstrap, defaultMode: 0444}}
        - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
        - {name: temporary, emptyDir: {}}