apiVersion: batch/v1
kind: Job
metadata:
  name: @@JOB_NAME@@
  namespace: remora-testbed
spec:
  activeDeadlineSeconds: 300
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      dnsPolicy: None
      dnsConfig:
        nameservers: [10.96.0.53]
        searches: [remora-testbed.svc.cluster.local, svc.cluster.local, cluster.local]
        options:
          - {name: ndots, value: "5"}
      initContainers:
        - name: durable-canary
          image: @@POSTGRES_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args: [psql "$DATABASE_URL" --set ON_ERROR_STOP=1 --command "SELECT 1"]
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
        - name: coordination-canary
          image: @@REDIS_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              key="${REMORA_COORDINATION_NAMESPACE}sample-canary"
              redis-cli -u "$REMORA_COORDINATION_URL" SET "$key" passed >/dev/null
              test "$(redis-cli -u "$REMORA_COORDINATION_URL" GET "$key")" = passed
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
        - name: oidc-canary
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              discovery="$(curl --fail --silent --show-error "$REMORA_OIDC_ISSUER/.well-known/openid-configuration")"
              printf '%s' "$discovery" | grep -F '"issuer"' >/dev/null
              printf '%s' "$discovery" | grep -F "$REMORA_OIDC_ISSUER" >/dev/null
              case "$REMORA_OIDC_PROVIDER" in
                keycloak) keys="$REMORA_OIDC_ISSUER/protocol/openid-connect/certs" ;;
                zitadel) keys="$REMORA_OIDC_ISSUER/oauth/v2/keys" ;;
                *) exit 1 ;;
              esac
              curl --fail --silent --show-error "$keys" | grep -F '"keys"' >/dev/null
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}
        - name: target-canary
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              export AWS_ACCESS_KEY_ID="$REMORA_TARGET_ACCESS_KEY"
              export AWS_SECRET_ACCESS_KEY="$REMORA_TARGET_SECRET_KEY"
              export AWS_DEFAULT_REGION="$REMORA_TARGET_REGION"
              key="${REMORA_TARGET_PREFIX}sample-canary"
              printf 'passed\n' >/tmp/input
              aws --endpoint-url "$REMORA_TARGET_ENDPOINT" s3api put-object --bucket "$REMORA_TARGET_BUCKET" --key "$key" --body /tmp/input >/dev/null
              aws --endpoint-url "$REMORA_TARGET_ENDPOINT" s3api get-object --bucket "$REMORA_TARGET_BUCKET" --key "$key" /tmp/output >/dev/null
              IFS= read -r output </tmp/output
              test "$output" = passed
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: "1", memory: 256Mi}
        - name: secret-canary
          image: @@VAULT_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              export VAULT_ADDR="$REMORA_VAULT_ADDR"
              export VAULT_TOKEN="$REMORA_VAULT_TOKEN"
              vault kv put "$REMORA_VAULT_PATH" value=passed >/dev/null
              test "$(vault kv get -field=value "$REMORA_VAULT_PATH")" = passed
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: "1", memory: 256Mi}
      containers:
        - name: tests
          image: @@TEST_IMAGE@@
          imagePullPolicy: Never
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          volumeMounts:
            - {name: fixture-profile, mountPath: /run/remora-fixture, readOnly: true}
          resources:
            requests: {cpu: 100m, memory: 64Mi}
            limits: {cpu: "2", memory: 512Mi}
      volumes:
        - name: fixture-profile
          configMap:
            name: @@PROFILE_NAME@@-file
            items:
              - {key: profile.env, path: profile.env}