{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- if .Values.disasterRecovery.enabled -}}
{{- $mergedLabels := mergeOverwrite (dict) .Values.commonLabels .Values.disasterRecovery.cronjob.podLabels -}}
apiVersion: {{ include "common.capabilities.cronjob.apiVersion" . }}
kind: CronJob
metadata:
  name: {{ printf "%s-snapshotter" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
  namespace: {{ .Release.Namespace | quote }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
spec:
  concurrencyPolicy: Forbid
  schedule: {{ .Values.disasterRecovery.cronjob.schedule | quote }}
  successfulJobsHistoryLimit: {{ .Values.disasterRecovery.cronjob.historyLimit }}
  jobTemplate:
    spec:
      template:
        metadata:
          labels: {{- include "common.labels.standard" ( dict "customLabels" $mergedLabels "context" $ ) | nindent 12 }}
            app.kubernetes.io/component: snapshotter
          {{- if .Values.disasterRecovery.cronjob.podAnnotations }}
          annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.disasterRecovery.cronjob.podAnnotations "context" $) | nindent 12 }}
          {{- end }}
        spec:
          {{- include "etcd.imagePullSecrets" . | nindent 10 }}
          {{- if .Values.disasterRecovery.cronjob.nodeSelector }}
          nodeSelector: {{-  toYaml .Values.disasterRecovery.cronjob.nodeSelector | nindent 12  }}
          {{- end }}
          {{- if .Values.disasterRecovery.cronjob.tolerations }}
          tolerations: {{- toYaml .Values.disasterRecovery.cronjob.tolerations | nindent 12 }}
          {{- end }}
          restartPolicy: OnFailure
          {{- if .Values.disasterRecovery.cronjob.podSecurityContext.enabled }}
          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.disasterRecovery.cronjob.podSecurityContext "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.disasterRecovery.cronjob.serviceAccountName }}
          serviceAccountName: {{ .Values.disasterRecovery.cronjob.serviceAccountName | quote }}
          {{- end }}
          {{- if and .Values.volumePermissions.enabled (or .Values.podSecurityContext.enabled .Values.containerSecurityContext.enabled) }}
          initContainers:
            - name: volume-permissions
              image: {{ include "etcd.volumePermissions.image" . }}
              imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
              command:
                - /bin/bash
                - -ec
                - |
                  chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /snapshots
              securityContext:
                runAsUser: 0
              {{- if .Values.volumePermissions.resources }}
              resources: {{- include "common.tplvalues.render" (dict "value" .Values.volumePermissions.resources "context" $) | nindent 16 }}
              {{- end }}
              volumeMounts:
                - name: snapshot-volume
                  mountPath: /snapshots
                - name: empty-dir
                  mountPath: /tmp
          {{- end }}
          containers:
            - name: etcd-snapshotter
              image: {{ include "etcd.image" . }}
              imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
              {{- if .Values.disasterRecovery.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.disasterRecovery.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
              {{- if .Values.diagnosticMode.enabled }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 16 }}
              args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 16 }}
              {{- else if .Values.disasterRecovery.cronjob.command }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.disasterRecovery.cronjob.command "context" $) | nindent 16 }}
              {{- else }}
              command:
                - /opt/bitnami/scripts/etcd/snapshot.sh
              {{- end }}
              env:
                - name: BITNAMI_DEBUG
                  value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }}
                - name: ETCDCTL_API
                  value: "3"
                - name: ETCD_ON_K8S
                  value: "yes"
                - name: MY_STS_NAME
                  value: {{ include "common.names.fullname" . | quote }}
                {{- $releaseNamespace := .Release.Namespace }}
                {{- $etcdFullname := include "common.names.fullname" . }}
                {{- $etcdHeadlessServiceName := (printf "%s-%s" $etcdFullname "headless" | trunc 63 | trimSuffix "-") }}
                {{- $clusterDomain := .Values.clusterDomain }}
                - name: ETCD_CLUSTER_DOMAIN
                  value: {{ printf "%s.%s.svc.%s" $etcdHeadlessServiceName $releaseNamespace $clusterDomain | quote }}
                - name: ETCD_SNAPSHOT_HISTORY_LIMIT
                  value: {{ .Values.disasterRecovery.cronjob.snapshotHistoryLimit | quote }}
                - name: ETCD_SNAPSHOTS_DIR
                  value: {{ .Values.disasterRecovery.cronjob.snapshotsDir | quote }}
                {{- if .Values.auth.client.secureTransport }}
                - name: ETCD_CERT_FILE
                  value: "/opt/bitnami/etcd/certs/client/{{ .Values.auth.client.certFilename }}"
                - name: ETCD_KEY_FILE
                  value: "/opt/bitnami/etcd/certs/client/{{ .Values.auth.client.certKeyFilename }}"
                {{- if .Values.auth.client.enableAuthentication }}
                - name: ETCD_CLIENT_CERT_AUTH
                  value: "true"
                - name: ETCD_TRUSTED_CA_FILE
                  value: "/opt/bitnami/etcd/certs/client/{{ .Values.auth.client.caFilename | default "ca.crt" }}"
                {{- else if .Values.auth.client.caFilename }}
                - name: ETCD_TRUSTED_CA_FILE
                  value: "/opt/bitnami/etcd/certs/client/{{ .Values.auth.client.caFilename }}"
                {{- else }}
                - name: ETCD_EXTRA_AUTH_FLAGS
                  value: "--insecure-skip-tls-verify"
                {{- end }}
                {{- end }}
                {{- if or .Values.auth.rbac.create .Values.auth.rbac.enabled }}
                {{- if .Values.usePasswordFiles }}
                - name: ETCD_ROOT_PASSWORD_FILE
                  value: {{ printf "/opt/bitnami/etcd/secrets/%s" (include "etcd.secretPasswordKey" .) }}
                {{- else }}
                - name: ETCD_ROOT_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "etcd.secretName" . }}
                      key: {{ include "etcd.secretPasswordKey" . }}
                {{- end }}
                {{- end }}
              {{- if .Values.disasterRecovery.cronjob.resources }}
              resources: {{- toYaml .Values.disasterRecovery.cronjob.resources | nindent 16 }}
              {{- else if ne .Values.disasterRecovery.cronjob.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.disasterRecovery.cronjob.resourcesPreset) | nindent 16 }}
              {{- end }}
              volumeMounts:
                - name: empty-dir
                  mountPath: /tmp
                  subPath: tmp-dir
                - name: snapshot-volume
                  mountPath: /snapshots
                  {{- if .Values.disasterRecovery.pvc.subPath }}
                  subPath: {{ .Values.disasterRecovery.pvc.subPath }}
                  {{- end }}
                {{- if .Values.auth.client.secureTransport }}
                - name: certs
                  mountPath: /opt/bitnami/etcd/certs/client
                  readOnly: true
                {{- end }}
                {{- if and .Values.usePasswordFiles (or .Values.auth.rbac.create .Values.auth.rbac.enabled) }}
                - name: etcd-secrets
                  mountPath: /opt/bitnami/etcd/secrets
                {{- end }}
          volumes:
            - name: empty-dir
              emptyDir: {}
            {{- if .Values.auth.client.secureTransport }}
            - name: certs
              secret:
                secretName: {{ required "A secret containing the client certificates is required" (tpl .Values.auth.client.existingSecret .) }}
                defaultMode: 256
            {{- end }}
            {{- if and .Values.usePasswordFiles (or .Values.auth.rbac.create .Values.auth.rbac.enabled) }}
            - name: etcd-secrets
              projected:
                sources:
                  - secret:
                      name:  {{ include "etcd.secretName" . }}
            {{- end }}
            - name: snapshot-volume
              persistentVolumeClaim:
                claimName: {{ include "etcd.disasterRecovery.pvc.name" . }}
{{- end }}
