---
# Connect through PgBouncer and wait long enough for TLS certificates to rotate.
apiVersion: batch/v1
kind: Job
metadata:
  name: psql-open-connection
  labels: { postgres-operator-test: kuttl }
spec:
  backoffLimit: 1
  template:
    metadata:
      labels: { postgres-operator-test: kuttl }
    spec:
      restartPolicy: Never
      volumes:
        # TODO(cbandy): Provide a CA bundle that clients can use for verification.
        - { name: tls, secret: { secretName: proxied-cluster-cert } }
      containers:
        - name: psql
          image: registry.developers.crunchydata.com/crunchydata/crunchy-postgres:centos8-14.1-0
          env:
            # Connect through PgBouncer.
            - name: PGURI
              valueFrom: { secretKeyRef: { name: proxied-pguser-proxied, key: pgbouncer-uri } }

            # Verify the certificate presented by PgBouncer.
            - { name: PGSSLMODE, value: verify-full }
            - { name: PGSSLROOTCERT, value: /mnt/ca.crt }

          volumeMounts:
            - { name: tls, mountPath: /mnt }

          command:
            - psql
            - $(PGURI)
            - -qAt
            - --set=ON_ERROR_STOP=1

            # Print connection details.
            - --command=SELECT pid, backend_start FROM pg_stat_activity WHERE pid = pg_backend_pid();

            # Wait here so later test steps can see this open connection.
            - --command=SELECT pg_sleep_for('5 minutes');
