# services/quality/zap-baseline-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: zap-baseline
  namespace: quality
spec:
  schedule: "17 4 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 604800
      backoffLimit: 1
      template:
        metadata:
          labels:
            app: zap-baseline
        spec:
          restartPolicy: Never
          nodeSelector:
            kubernetes.io/arch: arm64
            node-role.kubernetes.io/worker: "true"
          affinity:
            nodeAffinity:
              preferredDuringSchedulingIgnoredDuringExecution:
                - weight: 90
                  preference:
                    matchExpressions:
                      - key: hardware
                        operator: In
                        values: ["rpi5"]
                - weight: 50
                  preference:
                    matchExpressions:
                      - key: hardware
                        operator: In
                        values: ["rpi4"]
          containers:
            - name: zap
              image: ghcr.io/zaproxy/zaproxy:2.17.0
              imagePullPolicy: IfNotPresent
              command:
                - /bin/bash
                - /zap/config/run_zap_baseline.sh
              env:
                - name: PUSHGATEWAY_URL
                  value: http://platform-quality-gateway.monitoring.svc.cluster.local:9091
                - name: QUALITY_GATE_JOB_NAME
                  value: platform-security-zap
                - name: ZAP_TARGET_FILE
                  value: /zap/config/targets.txt
                - name: ZAP_SPIDER_MINUTES
                  value: "1"
                - name: ZAP_MAX_SCAN_MINUTES
                  value: "5"
              resources:
                requests:
                  cpu: 100m
                  memory: 1Gi
                limits:
                  cpu: "2"
                  memory: 2Gi
              volumeMounts:
                - name: config
                  mountPath: /zap/config
                  readOnly: true
                - name: work
                  mountPath: /zap/wrk
          volumes:
            - name: config
              configMap:
                name: zap-baseline-config
                defaultMode: 0755
            - name: work
              emptyDir: {}