chore: organize one-off jobs

clusters/atlas/flux-system/applications/bstein-dev-home-migrations/kustomization.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 10m
-  path: ./services/bstein-dev-home/migrations
+  path: ./services/bstein-dev-home/oneoffs/migrations
   prune: true
   force: true
   sourceRef:

services/bstein-dev-home/kustomization.yaml

@@ -16,7 +16,7 @@ resources:
   - backend-deployment.yaml
   - backend-service.yaml
   - vaultwarden-cred-sync-cronjob.yaml
-  - portal-onboarding-e2e-test-job.yaml
+  - oneoffs/portal-onboarding-e2e-test-job.yaml
   - ingress.yaml
 images:
   - name: registry.bstein.dev/bstein/bstein-dev-home-frontend

services/bstein-dev-home/oneoffs/migrations/kustomization.yaml

@@ -1,4 +1,4 @@
-# services/bstein-dev-home/migrations/kustomization.yaml
+# services/bstein-dev-home/oneoffs/migrations/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: bstein-dev-home

services/bstein-dev-home/oneoffs/migrations/portal-migrate-job.yaml

@@ -1,4 +1,8 @@
-# services/bstein-dev-home/migrations/portal-migrate-job.yaml
+# services/bstein-dev-home/oneoffs/migrations/portal-migrate-job.yaml
+# One-off job for bstein-dev-home/bstein-dev-home-portal-migrate-36.
+# Purpose: bstein dev home portal migrate 36 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -7,6 +11,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/force: "true"
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 3600
   template:

services/bstein-dev-home/oneoffs/portal-onboarding-e2e-test-job.yaml

@@ -1,10 +1,15 @@
-# services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml
+# services/bstein-dev-home/oneoffs/portal-onboarding-e2e-test-job.yaml
+# One-off job for bstein-dev-home/portal-onboarding-e2e-test-27.
+# Purpose: portal onboarding e2e test 27 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: portal-onboarding-e2e-test-27
   namespace: bstein-dev-home
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/comms/kustomization.yaml

@@ -22,24 +22,24 @@ resources:
   - mas-db-ensure-rbac.yaml
   - synapse-signingkey-ensure-rbac.yaml
   - vault-sync-deployment.yaml
-  - mas-admin-client-secret-ensure-job.yaml
+  - oneoffs/mas-admin-client-secret-ensure-job.yaml
-  - mas-db-ensure-job.yaml
+  - oneoffs/mas-db-ensure-job.yaml
-  - comms-secrets-ensure-job.yaml
+  - oneoffs/comms-secrets-ensure-job.yaml
-  - synapse-admin-ensure-job.yaml
+  - oneoffs/synapse-admin-ensure-job.yaml
-  - synapse-signingkey-ensure-job.yaml
+  - oneoffs/synapse-signingkey-ensure-job.yaml
-  - synapse-seeder-admin-ensure-job.yaml
+  - oneoffs/synapse-seeder-admin-ensure-job.yaml
-  - synapse-user-seed-job.yaml
+  - oneoffs/synapse-user-seed-job.yaml
-  - mas-local-users-ensure-job.yaml
+  - oneoffs/mas-local-users-ensure-job.yaml
   - mas-deployment.yaml
   - livekit-token-deployment.yaml
   - livekit.yaml
   - coturn.yaml
   - seed-othrys-room.yaml
   - guest-name-job.yaml
-  - othrys-kick-numeric-job.yaml
+  - oneoffs/othrys-kick-numeric-job.yaml
   - pin-othrys-job.yaml
   - reset-othrys-room-job.yaml
-  - bstein-force-leave-job.yaml
+  - oneoffs/bstein-force-leave-job.yaml
   - livekit-ingress.yaml
   - livekit-middlewares.yaml
   - matrix-ingress.yaml

services/comms/oneoffs/bstein-force-leave-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/bstein-force-leave-job.yaml
+# services/comms/oneoffs/bstein-force-leave-job.yaml
+# One-off job for comms/bstein-leave-rooms-12.
+# Purpose: bstein leave rooms 12 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: bstein-leave-rooms-12
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/comms/oneoffs/comms-secrets-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/comms-secrets-ensure-job.yaml
+# services/comms/oneoffs/comms-secrets-ensure-job.yaml
+# One-off job for comms/comms-secrets-ensure-7.
+# Purpose: comms secrets ensure 7 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: comms-secrets-ensure-7
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 3600
   template:

services/comms/oneoffs/mas-admin-client-secret-ensure-job.yaml

@@ -1,4 +1,8 @@
-# services/comms/mas-admin-client-secret-ensure-job.yaml
+# services/comms/oneoffs/mas-admin-client-secret-ensure-job.yaml
+# One-off job for comms/mas-admin-client-secret-writer.
+# Purpose: mas admin client secret writer (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -41,6 +45,7 @@ metadata:
   name: mas-admin-client-secret-ensure-11
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 2
   template:
     spec:

services/comms/oneoffs/mas-db-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/mas-db-ensure-job.yaml
+# services/comms/oneoffs/mas-db-ensure-job.yaml
+# One-off job for comms/mas-db-ensure-22.
+# Purpose: mas db ensure 22 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: mas-db-ensure-22
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 600
   template:

services/comms/oneoffs/mas-local-users-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/mas-local-users-ensure-job.yaml
+# services/comms/oneoffs/mas-local-users-ensure-job.yaml
+# One-off job for comms/mas-local-users-ensure-18.
+# Purpose: mas local users ensure 18 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: mas-local-users-ensure-18
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 3600
   template:

services/comms/oneoffs/othrys-kick-numeric-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/othrys-kick-numeric-job.yaml
+# services/comms/oneoffs/othrys-kick-numeric-job.yaml
+# One-off job for comms/othrys-kick-numeric-8.
+# Purpose: othrys kick numeric 8 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: othrys-kick-numeric-8
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/comms/oneoffs/synapse-admin-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/synapse-admin-ensure-job.yaml
+# services/comms/oneoffs/synapse-admin-ensure-job.yaml
+# One-off job for comms/synapse-admin-ensure-3.
+# Purpose: synapse admin ensure 3 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: synapse-admin-ensure-3
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/comms/oneoffs/synapse-seeder-admin-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/synapse-seeder-admin-ensure-job.yaml
+# services/comms/oneoffs/synapse-seeder-admin-ensure-job.yaml
+# One-off job for comms/synapse-seeder-admin-ensure-9.
+# Purpose: synapse seeder admin ensure 9 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: synapse-seeder-admin-ensure-9
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 2
   template:
     metadata:

services/comms/oneoffs/synapse-signingkey-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/synapse-signingkey-ensure-job.yaml
+# services/comms/oneoffs/synapse-signingkey-ensure-job.yaml
+# One-off job for comms/othrys-synapse-signingkey-ensure-7.
+# Purpose: othrys synapse signingkey ensure 7 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: othrys-synapse-signingkey-ensure-7
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 2
   template:
     spec:

services/comms/oneoffs/synapse-user-seed-job.yaml

@@ -1,10 +1,15 @@
-# services/comms/synapse-user-seed-job.yaml
+# services/comms/oneoffs/synapse-user-seed-job.yaml
+# One-off job for comms/synapse-user-seed-8.
+# Purpose: synapse user seed 8 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: synapse-user-seed-8
   namespace: comms
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 3600
   template:

services/finance/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
   - finance-secrets-ensure-rbac.yaml
   - actual-budget-data-pvc.yaml
   - firefly-storage-pvc.yaml
-  - finance-secrets-ensure-job.yaml
+  - oneoffs/finance-secrets-ensure-job.yaml
   - actual-budget-deployment.yaml
   - firefly-deployment.yaml
   - firefly-user-sync-cronjob.yaml

services/finance/oneoffs/finance-secrets-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/finance/finance-secrets-ensure-job.yaml
+# services/finance/oneoffs/finance-secrets-ensure-job.yaml
+# One-off job for finance/finance-secrets-ensure-5.
+# Purpose: finance secrets ensure 5 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: finance-secrets-ensure-5
   namespace: finance
 spec:
+  suspend: true
   backoffLimit: 1
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/kustomization.yaml

@@ -10,21 +10,21 @@ resources:
   - secretproviderclass.yaml
   - vault-sync-deployment.yaml
   - deployment.yaml
-  - realm-settings-job.yaml
+  - oneoffs/realm-settings-job.yaml
-  - portal-admin-client-secret-ensure-job.yaml
+  - oneoffs/portal-admin-client-secret-ensure-job.yaml
-  - portal-e2e-client-job.yaml
+  - oneoffs/portal-e2e-client-job.yaml
-  - portal-e2e-target-client-job.yaml
+  - oneoffs/portal-e2e-target-client-job.yaml
-  - portal-e2e-token-exchange-permissions-job.yaml
+  - oneoffs/portal-e2e-token-exchange-permissions-job.yaml
-  - portal-e2e-token-exchange-test-job.yaml
+  - oneoffs/portal-e2e-token-exchange-test-job.yaml
-  - portal-e2e-execute-actions-email-test-job.yaml
+  - oneoffs/portal-e2e-execute-actions-email-test-job.yaml
-  - ldap-federation-job.yaml
+  - oneoffs/ldap-federation-job.yaml
-  - user-overrides-job.yaml
+  - oneoffs/user-overrides-job.yaml
-  - mas-secrets-ensure-job.yaml
+  - oneoffs/mas-secrets-ensure-job.yaml
-  - synapse-oidc-secret-ensure-job.yaml
+  - oneoffs/synapse-oidc-secret-ensure-job.yaml
-  - logs-oidc-secret-ensure-job.yaml
+  - oneoffs/logs-oidc-secret-ensure-job.yaml
-  - harbor-oidc-secret-ensure-job.yaml
+  - oneoffs/harbor-oidc-secret-ensure-job.yaml
-  - vault-oidc-secret-ensure-job.yaml
+  - oneoffs/vault-oidc-secret-ensure-job.yaml
-  - actual-oidc-secret-ensure-job.yaml
+  - oneoffs/actual-oidc-secret-ensure-job.yaml
   - service.yaml
   - ingress.yaml
 generatorOptions:

services/keycloak/oneoffs/actual-oidc-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/actual-oidc-secret-ensure-job.yaml
+# services/keycloak/oneoffs/actual-oidc-secret-ensure-job.yaml
+# One-off job for sso/actual-oidc-secret-ensure-3.
+# Purpose: actual oidc secret ensure 3 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: actual-oidc-secret-ensure-3
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/harbor-oidc-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/harbor-oidc-secret-ensure-job.yaml
+# services/keycloak/oneoffs/harbor-oidc-secret-ensure-job.yaml
+# One-off job for sso/harbor-oidc-secret-ensure-10.
+# Purpose: harbor oidc secret ensure 10 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: harbor-oidc-secret-ensure-10
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/ldap-federation-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/ldap-federation-job.yaml
+# services/keycloak/oneoffs/ldap-federation-job.yaml
+# One-off job for sso/keycloak-ldap-federation-12.
+# Purpose: keycloak ldap federation 12 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-ldap-federation-12
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 2
   template:
     metadata:

services/keycloak/oneoffs/logs-oidc-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/logs-oidc-secret-ensure-job.yaml
+# services/keycloak/oneoffs/logs-oidc-secret-ensure-job.yaml
+# One-off job for sso/logs-oidc-secret-ensure-10.
+# Purpose: logs oidc secret ensure 10 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: logs-oidc-secret-ensure-10
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/mas-secrets-ensure-job.yaml

@@ -1,4 +1,8 @@
-# services/keycloak/mas-secrets-ensure-job.yaml
+# services/keycloak/oneoffs/mas-secrets-ensure-job.yaml
+# One-off job for sso/mas-secrets-ensure.
+# Purpose: mas secrets ensure (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -13,6 +17,7 @@ metadata:
   name: mas-secrets-ensure-21
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-admin-client-secret-ensure-job.yaml
+# services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml
+# One-off job for sso/keycloak-portal-admin-secret-ensure-4.
+# Purpose: keycloak portal admin secret ensure 4 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-admin-secret-ensure-4
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/portal-e2e-client-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-e2e-client-job.yaml
+# services/keycloak/oneoffs/portal-e2e-client-job.yaml
+# One-off job for sso/keycloak-portal-e2e-client-8.
+# Purpose: keycloak portal e2e client 8 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-e2e-client-8
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/portal-e2e-execute-actions-email-test-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-e2e-execute-actions-email-test-job.yaml
+# services/keycloak/oneoffs/portal-e2e-execute-actions-email-test-job.yaml
+# One-off job for sso/keycloak-portal-e2e-execute-actions-email-14.
+# Purpose: keycloak portal e2e execute actions email 14 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-e2e-execute-actions-email-14
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 3
   template:
     metadata:

services/keycloak/oneoffs/portal-e2e-target-client-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-e2e-target-client-job.yaml
+# services/keycloak/oneoffs/portal-e2e-target-client-job.yaml
+# One-off job for sso/keycloak-portal-e2e-target-7.
+# Purpose: keycloak portal e2e target 7 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-e2e-target-7
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/portal-e2e-token-exchange-permissions-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-e2e-token-exchange-permissions-job.yaml
+# services/keycloak/oneoffs/portal-e2e-token-exchange-permissions-job.yaml
+# One-off job for sso/keycloak-portal-e2e-token-exchange-permissions-11.
+# Purpose: keycloak portal e2e token exchange permissions 11 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-e2e-token-exchange-permissions-11
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 6
   template:
     metadata:

services/keycloak/oneoffs/portal-e2e-token-exchange-test-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/portal-e2e-token-exchange-test-job.yaml
+# services/keycloak/oneoffs/portal-e2e-token-exchange-test-job.yaml
+# One-off job for sso/keycloak-portal-e2e-token-exchange-test-7.
+# Purpose: keycloak portal e2e token exchange test 7 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-portal-e2e-token-exchange-test-7
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 6
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/realm-settings-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/realm-settings-job.yaml
+# services/keycloak/oneoffs/realm-settings-job.yaml
+# One-off job for sso/keycloak-realm-settings-36.
+# Purpose: keycloak realm settings 36 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-realm-settings-36
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/synapse-oidc-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/synapse-oidc-secret-ensure-job.yaml
+# services/keycloak/oneoffs/synapse-oidc-secret-ensure-job.yaml
+# One-off job for sso/synapse-oidc-secret-ensure-10.
+# Purpose: synapse oidc secret ensure 10 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: synapse-oidc-secret-ensure-10
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/keycloak/oneoffs/user-overrides-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/user-overrides-job.yaml
+# services/keycloak/oneoffs/user-overrides-job.yaml
+# One-off job for sso/keycloak-user-overrides-9.
+# Purpose: keycloak user overrides 9 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: keycloak-user-overrides-9
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   template:
     metadata:

services/keycloak/oneoffs/vault-oidc-secret-ensure-job.yaml

@@ -1,10 +1,15 @@
-# services/keycloak/vault-oidc-secret-ensure-job.yaml
+# services/keycloak/oneoffs/vault-oidc-secret-ensure-job.yaml
+# One-off job for sso/vault-oidc-secret-ensure-8.
+# Purpose: vault oidc secret ensure 8 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: vault-oidc-secret-ensure-8
   namespace: sso
 spec:
+  suspend: true
   backoffLimit: 0
   ttlSecondsAfterFinished: 3600
   template:

services/logging/kustomization.yaml

@@ -15,9 +15,9 @@ resources:
   - opensearch-dashboards-helmrelease.yaml
   - data-prepper-helmrelease.yaml
   - otel-collector-helmrelease.yaml
-  - opensearch-ism-job.yaml
+  - oneoffs/opensearch-ism-job.yaml
-  - opensearch-dashboards-setup-job.yaml
+  - oneoffs/opensearch-dashboards-setup-job.yaml
-  - opensearch-observability-setup-job.yaml
+  - oneoffs/opensearch-observability-setup-job.yaml
   - opensearch-prune-cronjob.yaml
   - fluent-bit-helmrelease.yaml
   - node-log-rotation-daemonset.yaml

services/logging/oneoffs/opensearch-dashboards-setup-job.yaml

@@ -1,10 +1,15 @@
-# services/logging/opensearch-dashboards-setup-job.yaml
+# services/logging/oneoffs/opensearch-dashboards-setup-job.yaml
+# One-off job for logging/opensearch-dashboards-setup-4.
+# Purpose: opensearch dashboards setup 4 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: opensearch-dashboards-setup-4
   namespace: logging
 spec:
+  suspend: true
   backoffLimit: 3
   ttlSecondsAfterFinished: 3600
   template:

services/logging/oneoffs/opensearch-ism-job.yaml

@@ -1,10 +1,15 @@
-# services/logging/opensearch-ism-job.yaml
+# services/logging/oneoffs/opensearch-ism-job.yaml
+# One-off job for logging/opensearch-ism-setup-5.
+# Purpose: opensearch ism setup 5 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: opensearch-ism-setup-5
   namespace: logging
 spec:
+  suspend: true
   backoffLimit: 3
   ttlSecondsAfterFinished: 3600
   template:

services/logging/oneoffs/opensearch-observability-setup-job.yaml

@@ -1,10 +1,15 @@
-# services/logging/opensearch-observability-setup-job.yaml
+# services/logging/oneoffs/opensearch-observability-setup-job.yaml
+# One-off job for logging/opensearch-observability-setup-2.
+# Purpose: opensearch observability setup 2 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: opensearch-observability-setup-2
   namespace: logging
 spec:
+  suspend: true
   backoffLimit: 3
   ttlSecondsAfterFinished: 3600
   template:

services/mailu/kustomization.yaml

@@ -13,7 +13,7 @@ resources:
   - unbound-configmap.yaml
   - serverstransport.yaml
   - ingressroute.yaml
-  - mailu-sync-job.yaml
+  - oneoffs/mailu-sync-job.yaml
   - mailu-sync-cronjob.yaml
   - front-lb.yaml
 

services/mailu/oneoffs/mailu-sync-job.yaml

@@ -1,10 +1,15 @@
-# services/mailu/mailu-sync-job.yaml
+# services/mailu/oneoffs/mailu-sync-job.yaml
+# One-off job for mailu-mailserver/mailu-sync-9.
+# Purpose: mailu sync 9 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: mailu-sync-9
   namespace: mailu-mailserver
 spec:
+  suspend: true
   template:
     metadata:
       annotations:

services/maintenance/kustomization.yaml

@@ -14,10 +14,10 @@ resources:
   - node-nofile-serviceaccount.yaml
   - pod-cleaner-rbac.yaml
   - ariadne-deployment.yaml
-  - ariadne-migrate-job.yaml
+  - oneoffs/ariadne-migrate-job.yaml
   - ariadne-service.yaml
   - disable-k3s-traefik-daemonset.yaml
-  - k3s-traefik-cleanup-job.yaml
+  - oneoffs/k3s-traefik-cleanup-job.yaml
   - node-nofile-daemonset.yaml
   - k3s-agent-restart-daemonset.yaml
   - pod-cleaner-cronjob.yaml

services/maintenance/oneoffs/ariadne-migrate-job.yaml

@@ -1,4 +1,8 @@
-# services/maintenance/ariadne-migrate-job.yaml
+# services/maintenance/oneoffs/ariadne-migrate-job.yaml
+# One-off job for maintenance/ariadne-migrate-2.
+# Purpose: ariadne migrate 2 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:

services/maintenance/oneoffs/k3s-traefik-cleanup-job.yaml

@@ -1,10 +1,15 @@
-# services/maintenance/k3s-traefik-cleanup-job.yaml
+# services/maintenance/oneoffs/k3s-traefik-cleanup-job.yaml
+# One-off job for maintenance/k3s-traefik-cleanup-2.
+# Purpose: k3s traefik cleanup 2 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: k3s-traefik-cleanup-2
   namespace: maintenance
 spec:
+  suspend: true
   backoffLimit: 1
   template:
     spec:

services/monitoring/kustomization.yaml

@@ -23,8 +23,8 @@ resources:
   - grafana-alerting-config.yaml
   - grafana-folders.yaml
   - helmrelease.yaml
-  - grafana-org-bootstrap.yaml
+  - oneoffs/grafana-org-bootstrap.yaml
-  - grafana-user-dedupe-job.yaml
+  - oneoffs/grafana-user-dedupe-job.yaml
 
 configMapGenerator:
   - name: postmark-exporter-script

services/monitoring/oneoffs/grafana-org-bootstrap.yaml

@@ -1,10 +1,15 @@
-# services/monitoring/grafana-org-bootstrap.yaml
+# services/monitoring/oneoffs/grafana-org-bootstrap.yaml
+# One-off job for monitoring/grafana-org-bootstrap-3.
+# Purpose: grafana org bootstrap 3 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: grafana-org-bootstrap-3
   namespace: monitoring
 spec:
+  suspend: true
   backoffLimit: 2
   template:
     metadata:

services/monitoring/oneoffs/grafana-user-dedupe-job.yaml

@@ -1,10 +1,15 @@
-# services/monitoring/grafana-user-dedupe-job.yaml
+# services/monitoring/oneoffs/grafana-user-dedupe-job.yaml
+# One-off job for monitoring/grafana-user-dedupe-api-v7.
+# Purpose: grafana user dedupe api v7 (see container args/env in this file).
+# Run by setting spec.suspend to false, reconcile, then set it back to true.
+# Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
   name: grafana-user-dedupe-api-v7
   namespace: monitoring
 spec:
+  suspend: true
   backoffLimit: 1
   template:
     metadata: