apiVersion: batch/v1
kind: Job
metadata:
  name: migration-flyway
  labels:
    app.kubernetes.io/name: migration-flyway
    app.kubernetes.io/instance: migration-flyway
    app.kubernetes.io/version: "0.1.0"
    app.kubernetes.io/component: migration
    app.kubernetes.io/part-of: auth-platform
    app.kubernetes.io/managed-by: kustomize
spec:
  parallelism: 1
  completions: 1
  backoffLimit: 0
  activeDeadlineSeconds: 1800
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        app.kubernetes.io/name: migration-flyway
        app.kubernetes.io/instance: migration-flyway
        app.kubernetes.io/version: "0.1.0"
        app.kubernetes.io/component: migration
        app.kubernetes.io/part-of: auth-platform
        app.kubernetes.io/managed-by: kustomize
    spec:
      serviceAccountName: migration-flyway-sa
      automountServiceAccountToken: false
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: flyway-info
          image: flyway/flyway:10.20.1
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-c"]
          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway info"]
          env: &flywayEnv
            - name: FLYWAY_URL
              value: jdbc:postgresql://identity-postgres:5432/auth_server
            - name: FLYWAY_LOCATIONS
              value: filesystem:/flyway/sql
            - name: FLYWAY_SCHEMAS
              value: auth
            - name: FLYWAY_DEFAULT_SCHEMA
              value: auth
            - name: FLYWAY_TABLE
              value: flyway_schema_history
            - name: FLYWAY_VALIDATE_ON_MIGRATE
              value: "true"
            - name: FLYWAY_BASELINE_ON_MIGRATE
              value: "false"
            - name: FLYWAY_OUT_OF_ORDER
              value: "false"
            - name: FLYWAY_MIXED
              value: "false"
            - name: FLYWAY_CLEAN_DISABLED
              value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 256Mi
          securityContext: &flywaySC
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            privileged: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts: &flywayVM
            - name: sql
              mountPath: /flyway/sql
              readOnly: true
            - name: db-secret
              mountPath: /run/secrets/db
              readOnly: true
            - name: tmp
              mountPath: /tmp
      containers:
        - name: flyway-migrate
          image: flyway/flyway:10.20.1
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-c"]
          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway migrate"]
          env: *flywayEnv
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              memory: 512Mi
          securityContext: *flywaySC
          volumeMounts: *flywayVM
      volumes:
        - name: sql
          configMap:
            name: migration-flyway-sql
        - name: db-secret
          secret:
            secretName: auth-server-db
            defaultMode: 0400
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 128Mi