# services/veles/feedback-mirror-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: veles-feedback-mirror
  namespace: veles
  labels:
    app: veles-feedback-mirror
spec:
  schedule: "*/15 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: veles-feedback-mirror
        spec:
          restartPolicy: Never
          serviceAccountName: veles-feedback-mirror
          automountServiceAccountToken: false
          priorityClassName: veles-core
          nodeSelector:
            veles.bstein.dev/node-pool: oceanus
            kubernetes.io/arch: amd64
          tolerations:
            - key: veles.bstein.dev/simulation
              operator: Equal
              value: "true"
              effect: NoSchedule
          securityContext:
            fsGroup: 10001
            fsGroupChangePolicy: OnRootMismatch
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: mirror
              image: registry.bstein.dev/veles/veles-backend:0.4.5 # {"$imagepolicy": "veles:veles-backend"}
              imagePullPolicy: IfNotPresent
              command: ["/bin/sh", "-c"]
              args:
                - |
                  set -eu
                  if [ -z "${GITEA_TOKEN:-}" ]; then
                    echo "No GITEA_TOKEN configured for feedback mirror; leaving existing mirror untouched."
                    exit 0
                  fi
                  exec veles-feedback-mirror \
                    --api-base-url "${VELES_FEEDBACK_GITEA_API_URL:-https://scm.bstein.dev/api/v1}" \
                    --repo "${VELES_FEEDBACK_REPO:-veles-alpha/feedback}" \
                    --output "${VELES_FEEDBACK_MIRROR_PATH:-/data/veles-artifacts/artifacts/feedback/issues.json}"
              envFrom:
                - configMapRef:
                    name: veles-config
              env:
                - name: GITEA_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: veles-feedback-mirror
                      key: GITEA_TOKEN
                      optional: true
              volumeMounts:
                - name: artifacts
                  mountPath: /data/veles-artifacts
              resources:
                requests:
                  cpu: 25m
                  memory: 128Mi
                limits:
                  cpu: 200m
                  memory: 384Mi
              securityContext:
                runAsNonRoot: true
                runAsUser: 10001
                runAsGroup: 10001
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
          volumes:
            - name: artifacts
              persistentVolumeClaim:
                claimName: veles-artifacts