apiVersion: batch/v1
kind: CronJob
metadata:
  name: harbor-cache-recovery
  namespace: harbor-system
  labels:
    app.kubernetes.io/name: harbor-cache-recovery
    app.kubernetes.io/part-of: osdc-harbor-cache-recovery
spec:
  schedule: "SCHEDULE_PLACEHOLDER"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 300
      template:
        metadata:
          labels:
            app.kubernetes.io/name: harbor-cache-recovery
            app.kubernetes.io/part-of: osdc-harbor-cache-recovery
        spec:
          serviceAccountName: harbor-cache-recovery
          restartPolicy: Never
          nodeSelector:
            role: base-infrastructure
          tolerations:
            - key: CriticalAddonsOnly
              operator: Exists
              effect: NoSchedule
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: harbor-cache-recovery
              image: HARBOR_CACHE_RECOVERY_IMAGE_PLACEHOLDER
              env:
                - name: PYTHONDONTWRITEBYTECODE
                  value: "1"
                - name: HARBOR_URL
                  value: "HARBOR_URL_PLACEHOLDER"
                - name: HARBOR_ADMIN_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: harbor-admin-password
                      key: password
                - name: MIN_POD_AGE_SECONDS
                  value: "MIN_POD_AGE_PLACEHOLDER"
                - name: DRY_RUN
                  value: "DRY_RUN_PLACEHOLDER"
              resources:
                requests:
                  cpu: 50m
                  memory: 1Gi
                limits:
                  cpu: 200m
                  memory: 2Gi
              securityContext:
                readOnlyRootFilesystem: true
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                    - ALL
