apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: github-sync
  namespace: github-admin
spec:
  concurrencyPolicy: Forbid
  # Run every 10 minutes
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        metadata:
          labels:
            job: github-sync
            version: master
        # Keep in sync with github-sync-job.yaml
        spec:
          initContainers:
          - name: checkout
            command:
            - /usr/local/bin/checkout_repos.sh
            - --repos=kubeflow/internal-acls@HEAD
            - --src_dir=/src
            image: gcr.io/kubeflow-admin/test-worker:v20190723-0a32b01-dirty-b7e34b
            volumeMounts:
            - mountPath: /src
              name: src
          # Validate the config to make sure insecure changes (e.g. addmins unallowed admins is blocked)
          - name: validate
            command:
            - python 
            - /code/validate_config.py
            - check-config 
            - /src/kubeflow/internal-acls/github-orgs/kubeflow/org.yaml 
            image: gcr.io/kubeflow-admin/test-worker:v20190723-0a32b01-dirty-b7e34b
            volumeMounts:
            - mountPath: /src
              name: src
            - mountPath: /code
              name: validate-code
          containers:
          - name: sync
            image: gcr.io/k8s-prow/peribolos@sha256:a1248c8793d5c99ed3b31c8ad1e27348cdaf5e11abc501629c9d636921460e9b
            env:
            - name: GITHUB_TOKEN
              valueFrom:
                secretKeyRef:
                  name: github-org-admin-token-bobgy
                  key: github_token
            command:
            - /app/prow/cmd/peribolos/app.binary.runfiles/io_k8s_test_infra/prow/cmd/peribolos/linux_amd64_pure_stripped/app.binary  
            - --fix-teams 
            - --fix-team-members 
            - --fix-org-members 
            - --fix-team-repos
            - --config-path=/src/kubeflow/internal-acls/github-orgs/kubeflow/org.yaml
            - --github-token-path=/secret/github-token/github_token
            - --required-admins=Bobgy
            - --required-admins=james-jwu
            - --required-admins=google-admin
            - --required-admins=googlebot
            - --confirm=true
            volumeMounts:
            - name: github-token
              mountPath: /secret/github-token
              readOnly: true
            - mountPath: /src
              name: src
          restartPolicy: Never
          volumes:
          - name: github-token
            secret:
              secretName: github-org-admin-token-bobgy
          - name: src
            emptyDir: {}
          - name: validate-code
            configMap:
              name: github-sync-code 
