apiVersion: batch/v1
kind: Job
metadata:
  name: tenant-engine-schema-migration
  namespace: tenant-engine
  labels:
    app.kubernetes.io/name: tenant-engine
    app.kubernetes.io/component: migration
spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tenant-engine-migration
    spec:
      automountServiceAccountToken: false
      restartPolicy: Never
      securityContext:
        fsGroup: 10001
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: migrate
        image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24
        args:
        - tenant-engine-migrate
        - --url-file
        - /var/run/secrets/postgres-migration/url
        - --role
        - tenant_engine_migrate
        env:
        - name: TENANT_ENGINE_MIGRATION_DATABASE_URL_FILE
          value: /var/run/secrets/postgres-migration/url
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 25m
            memory: 48Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/run/secrets/postgres-migration
          name: postgres-migration
          readOnly: true
      volumes:
      - name: postgres-migration
        secret:
          defaultMode: 0440
          secretName: tenant-engine-postgres-migration
          items:
          - key: url
            path: url
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-engine-schema-migration
  namespace: tenant-engine
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: tenant-engine-migration
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: databases
      podSelector:
        matchLabels:
          cnpg.io/cluster: platform-pg
    ports:
    - {port: 5432, protocol: TCP}
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - {port: 53, protocol: UDP}
    - {port: 53, protocol: TCP}