---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
    app.kubernetes.io/component: dns-record-updater
    app.kubernetes.io/instance: default
    app.kubernetes.io/name: my-dynds
  name: my-dyndns
  namespace: default
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      activeDeadlineSeconds: 120
      backoffLimit: 0
      completions: 1
      parallelism: 1
      template:
        metadata:
          labels:
            app.kubernetes.io/component: dns-record-updater
            app.kubernetes.io/instance: default
            app.kubernetes.io/name: my-dynds
            app.kubernetes.io/version: v1.0.0
        spec:
          containers:
          - command:
            - /usr/local/bin/public-ip-sync-google-clouddns
            image: docker.io/headcr4sh/public-ip-sync-google-clouddns:latest-arm64
            imagePullPolicy: IfNotPresent
            name: my-dyndns
            env:
            - name: DEBUG
              value: "FALSE"
            - name: GCLOUD_SERVICE_ACCOUNT_KEY_FILE
              value: /etc/my-dyndns/gcloud-service-account-key.json
            envFrom:
            - configMapRef:
                name: my-dyndns-gcloud-env
            resources:
              limits:
                cpu: 200m
                memory: 48Mi
              requests:
                cpu: 100m
                memory: 48Mi
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop:
                - ALL
              readOnlyRootFilesystem: true
              runAsNonRoot: true
            volumeMounts:
            - name: credentials
              mountPath: "/etc/my-dyndns"
              readOnly: true
            - name: tmp-config
              mountPath: "/var/lib/my-dyndns/.config/"
              readOnly: false
            - name: tmp-workdir
              mountPath: "/var/lib/my-dyndns/work/"
              readOnly: false
            workingDir: /var/lib/my-dyndns/work
          dnsConfig:
            nameservers:
            - "8.8.8.8"
            - "8.8.4.4"
          dnsPolicy: None
          nodeSelector:
            kubernetes.io/arch: arm64
            kubernetes.io/os: linux
            node-role.kubernetes.io/master: ""
          restartPolicy: Never
          schedulerName: default-scheduler
          securityContext:
            runAsUser: 2000
            runAsGroup: 2000
            fsGroup: 2000
          serviceAccountName: my-dyndns
          terminationGracePeriodSeconds: 10
          tolerations:
          - effect: NoSchedule
            key: node-role.kubernetes.io/master
          volumes:
          - name: credentials
            secret:
              secretName: my-dyndns-gcloud-credentials
              items:
              - key: gcloud-service-account-key.json
                path: gcloud-service-account-key.json
          - name: tmp-config
            emptyDir: {}
          - name: tmp-workdir
            emptyDir: {}
      ttlSecondsAfterFinished: 120
  schedule: "*/10 * * * *"
  successfulJobsHistoryLimit: 1
  suspend: false
...
