apiVersion: batch/v1
kind: CronJob
metadata:
  name: ql3-plugin-package-executor
  namespace: qinglong3-system
  labels:
    app.kubernetes.io/name: ql3-plugin-package-executor
    app.kubernetes.io/component: plugin-package-executor
    app.kubernetes.io/part-of: qinglong3
spec:
  schedule: '*/2 * * * *'
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 60
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      ttlSecondsAfterFinished: 600
      template:
        metadata:
          labels:
            app.kubernetes.io/name: ql3-plugin-package-executor
            app.kubernetes.io/component: plugin-package-executor
            app.kubernetes.io/part-of: qinglong3
        spec:
          serviceAccountName: ql3-plugin-package-executor
          automountServiceAccountToken: true
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 10001
            runAsGroup: 10001
            fsGroup: 10001
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: executor
              image: qinglong3-cluster-admin:3.0.0-alpha.2
              imagePullPolicy: IfNotPresent
              command:
                - node
                - /opt/qinglong/node_modules/@qinglong/cluster-admin/dist/plugin-package/executor/pluginPackageExecutorCli.js
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              env:
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_ENABLED
                  value: 'true'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_OWNER
                  value: cluster_package_executor
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_APPROVAL_BATCH_SIZE
                  value: '8'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_DISPATCH_BATCH_SIZE
                  value: '8'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_MAX_BATCHES
                  value: '4'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_LEASE_DURATION_MS
                  value: '600000'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_PAGE_SIZE
                  value: '16'
                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
                  value: '16'
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_ENABLED
                  value: 'true'
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_LIMIT
                  value: '8'
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_NAMESPACE
                  value: qinglong3-system
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SERVICE_ACCOUNT
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: serviceAccountName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SOURCE_SECRET
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: sourceSecretName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_IMAGE
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: image
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_SECRET
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresCaSecretName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_KEY
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresCaKey
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_SERVERNAME
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresServerName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_SECRET
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresUrlSecretName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_KEY
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresUrlSecretKey
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_AUTH_SECRET
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresAuthSecretName
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_HOST
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresHost
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PORT
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresPort
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_DATABASE
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresDatabase
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_USERNAME_KEY
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresUsernameKey
                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PASSWORD_KEY
                  valueFrom:
                    configMapKeyRef:
                      name: ql3-plugin-package-secret-action-admission
                      key: postgresPasswordKey
                - name: QL3_POSTGRES_TLS_MODE
                  value: verify-full
                - name: QL3_POSTGRES_TLS_CA_FILE
                  value: /var/run/secrets/qinglong3/postgres-package-executor/ca.crt
                - name: QL3_POSTGRES_APPLICATION_NAME
                  value: qinglong3-plugin-package-executor
                - name: QL3_POSTGRES_MAX_CONNECTIONS
                  value: '2'
                - name: QL3_POSTGRES_PACKAGE_EXECUTOR_URL
                  valueFrom:
                    secretKeyRef:
                      name: ql3-cluster-plugin-package-executor
                      key: postgres-package-executor-url
                - name: QL3_POSTGRES_TLS_SERVERNAME
                  valueFrom:
                    secretKeyRef:
                      name: ql3-cluster-plugin-package-executor
                      key: postgres-tls-servername
              resources:
                requests:
                  cpu: 50m
                  memory: 64Mi
                limits:
                  cpu: 500m
                  memory: 256Mi
              volumeMounts:
                - name: tmp
                  mountPath: /tmp
                - name: postgres-package-executor-ca
                  mountPath: /var/run/secrets/qinglong3/postgres-package-executor
                  readOnly: true
          volumes:
            - name: tmp
              emptyDir:
                medium: Memory
                sizeLimit: 8Mi
            - name: postgres-package-executor-ca
              secret:
                secretName: ql3-cluster-plugin-package-executor
                defaultMode: 292
                items:
                  - key: postgres-ca.crt
                    path: ca.crt