---
apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app.kubernetes.io/component: generate-types
    app.kubernetes.io/instance: puppetserver
    app.kubernetes.io/name: puppetserver
    app.kubernetes.io/version: 8.8.0
  name: generate-types
  namespace: puppet
spec:
  schedule: "*/5 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app.kubernetes.io/component: generate-types
            app.kubernetes.io/instance: puppetserver
            app.kubernetes.io/name: puppetserver
            app.kubernetes.io/version: 8.8.0
        spec:
          hostname: generate-types
          imagePullSecrets: null
          containers:
            - name: generate-types
              image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
              imagePullPolicy: IfNotPresent
              command:
                - sh
                - -c
              args:
                - |
                  /opt/puppetlabs/puppet/bin/gem install deep_merge ipaddr hiera-eyaml toml
                  find /etc/puppetlabs/code/environments -mindepth 1 -maxdepth 1 -type d | while read -r envdir; do
                    env="$(basename "$envdir")"
                    echo "Generating types for $env"
                    puppet generate types --environment "$env"
                  done
              env: []
              resources:
                limits:
                  cpu: 300m
                  memory: 1Gi
                requests:
                  cpu: 50m
                  memory: 512Mi
              securityContext:
                runAsUser: 0
                runAsNonRoot: false
                allowPrivilegeEscalation: false
                # Root to `gem install` into the image's root-owned gem dir and
                # to `runuser` for `puppet generate types` (SETUID/SETGID).
                capabilities:
                  add:
                    - CHOWN
                    - DAC_OVERRIDE
                    - FOWNER
                    - SETGID
                    - SETUID
                  drop:
                    - all
              volumeMounts:
                - mountPath: /etc/puppetlabs/code/
                  name: puppet-code-volume
                - mountPath: /etc/puppetlabs/puppet/
                  name: puppet-puppet-volume
          restartPolicy: OnFailure
          securityContext:
            fsGroup: 999
            seccompProfile:
              type: RuntimeDefault
          volumes:
            - name: puppet-code-volume
              persistentVolumeClaim:
                claimName: puppetserver-code-shared
            - name: puppet-puppet-volume
              persistentVolumeClaim:
                claimName: puppetserver-compiler-config-shared
