# Laufrollen aus einem Image (Spec 2026-10-12 Abschnitt 2): api (Patch auf
# apicore-backend), worker (eigenes Deployment) und job (CronJobs).
# Rollout: Runbook Schritt 3, erst nachdem das Secret die neuen Schluessel hat.
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
resources:
  - worker-deployment.yaml
  - cronjobs.yaml
patches:
  - path: patch-api.yaml
  # Gemeinsam fuer alle App-CronJobs; cronjobs.yaml haelt nur, was je Job
  # verschieden ist. Werte laut Plan 2026-10-13 "Global Constraints".
  - target:
      kind: CronJob
      labelSelector: app=apicore-job
    patch: |-
      apiVersion: batch/v1
      kind: CronJob
      metadata:
        name: any-app-job
      spec:
        timeZone: Europe/Berlin
        concurrencyPolicy: Forbid
        startingDeadlineSeconds: 600
        successfulJobsHistoryLimit: 3
        failedJobsHistoryLimit: 3
        jobTemplate:
          spec:
            ttlSecondsAfterFinished: 86400
            template:
              spec:
                restartPolicy: Never
                automountServiceAccountToken: false
                securityContext:
                  runAsNonRoot: true
                  runAsUser: 1000
                  runAsGroup: 1000
                  seccompProfile:
                    type: RuntimeDefault
                volumes:
                  - name: tmp
                    emptyDir: {}
                containers:
                  - name: job
                    image: git.encry.de/nick.rosenloecher/apicore-backend
                    imagePullPolicy: IfNotPresent
                    env:
                      - name: APICORE_ROLE
                        value: job
                      - name: HOME
                        value: /tmp
                    envFrom:
                      - configMapRef:
                          name: apicore-backend-config
                      - secretRef:
                          name: apicore-backend-secret
                    securityContext:
                      allowPrivilegeEscalation: false
                      readOnlyRootFilesystem: true
                      capabilities:
                        drop: ["ALL"]
                    volumeMounts:
                      - name: tmp
                        mountPath: /tmp
                    resources:
                      requests:
                        cpu: 50m
                        memory: 192Mi
                      limits:
                        cpu: 500m
                        memory: 512Mi