---
apiVersion: batch/v1
kind: Job
metadata:
  name: "gin-test-connection"
  namespace: portfolio
  annotations:
    "helm.sh/hook": test
    kube-score/ignore: pod-networkpolicy, container-security-context-user-group-id
    # pod-networkpolicy: kind not support NetworkPolicy
    # https://github.com/kubernetes-sigs/kind/issues/842
    # container-security-context-user-group-id: false positive?
spec:
  template:
    metadata:
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: "runtime/default"
        sidecar.istio.io/inject: "false"
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
      containers:
        - name: wget
          # busybox:1.34.1
          image: busybox@sha256:52817dece4cfe26f581c834d27a8e1bcc82194f914afe6d50afad5a101234ef1
          imagePullPolicy: Always
          command: ['wget']
          args:
            - 'http://gin:{{ .Values.internal.port }}/healthz'
            - '-O'
            - '-'
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            runAsUser: 65534 # nobody
            capabilities:
              drop:
                - ALL
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - 'ps -A | grep wget'
          # ignore CUSTOM_CONTAINERS_MISSING_READINESSPROBE of datree
          # https://github.com/datreeio/datree/issues/398
          readinessProbe:
            exec:
              command: ["true"]
          resources:
            limits:
              cpu: 100m
              memory: 128Mi
              ephemeral-storage: 1Gi
            requests:
              cpu: 100m
              memory: 128Mi
              ephemeral-storage: 1Gi
      restartPolicy: Never
