apiVersion: batch/v1
kind: CronJob
metadata:
  name: acl-updater
  namespace: infrastructure
spec:
  schedule: "*/1 * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            container.seccomp.security.alpha.kubernetes.io/acl-updater: runtime/default
        spec:
          restartPolicy: OnFailure
          containers:
            - name: acl-updater
              image: ghcr.io/czarsimon/tactics-trainer/acl-updater:1.0.0
              imagePullPolicy: IfNotPresent
              env:
                - name: SCALEWAY_REGION
                  value: "fr-par"
                - name: K8S_CLUSTER_ID
                  value: "3e4dcb12-1fb1-4ca1-b524-dfa0fe79a91b"
                - name: RDB_INSTANCE_ID
                  value: "9ddb7ec0-dff5-4c7a-a9e4-551cc15224e4"
                - name: SCW_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: scaleway-api-credentials
                      key: accessKey
                - name: SCW_SECRET_KEY
                  valueFrom:
                    secretKeyRef:
                      name: scaleway-api-credentials
                      key: secretKey
              resources:
                requests:
                  memory: 50Mi
                  cpu: 50m
                limits:
                  memory: 100Mi
                  cpu: 100m
              securityContext:
                seccompProfile:
                  type: RuntimeDefault
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
                runAsNonRoot: true
                readOnlyRootFilesystem: true
                runAsUser: 10001
                runAsGroup: 10001
