apiVersion: batch/v1
kind: Job
metadata:
  name: user-engine-restore-drill
  namespace: user-engine
  labels:
    app.kubernetes.io/name: user-engine-restore-drill
    app.kubernetes.io/part-of: user-engine
spec:
  backoffLimit: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: user-engine-restore-drill
        app.kubernetes.io/part-of: user-engine
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 26
        runAsGroup: 26
        fsGroup: 26
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: restore
          image: ghcr.io/cloudnative-pg/postgresql:17.5
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -ec
            - |
              latest="$(find /backup -type f -name 'user-engine-*.dump' | sort | tail -1)"
              test -n "${latest}"
              sha256sum --check "${latest}.sha256"
              initdb --no-locale --encoding=UTF8 -D /restore/data >/dev/null
              pg_ctl -D /restore/data -o '-k /tmp -p 55432' -w start >/dev/null
              trap 'pg_ctl -D /restore/data -m immediate stop >/dev/null' EXIT
              createdb -h /tmp -p 55432 user_engine_restore
              pg_restore --exit-on-error --no-owner --no-acl \
                -h /tmp -p 55432 -d user_engine_restore "${latest}"
              tables="$(psql -At -h /tmp -p 55432 -d user_engine_restore \
                -c "select count(*) from pg_catalog.pg_tables where schemaname='public'")"
              migrations="$(psql -At -h /tmp -p 55432 -d user_engine_restore \
                -c 'select count(*) from user_engine_schema_versions')"
              test "${tables}" -gt 0
              test "${migrations}" -gt 0
              echo "restore_complete tables=${tables} migrations=${migrations}"
          volumeMounts:
            - {name: backup, mountPath: /backup, readOnly: true}
            - {name: restore, mountPath: /restore}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
          resources:
            requests: {cpu: 50m, memory: 128Mi}
            limits: {cpu: "1", memory: 512Mi}
      volumes:
        - name: backup
          persistentVolumeClaim: {claimName: user-engine-backups}
        - name: restore
          emptyDir: {}