# services/gitea/atlas-identity-bootstrap-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: gitea-atlas-identity-bootstrap-5
  namespace: gitea
  annotations:
    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
  labels:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/component: identity-bootstrap
spec:
  backoffLimit: 4
  template:
    metadata:
      labels:
        app.kubernetes.io/name: gitea
        app.kubernetes.io/component: identity-bootstrap
    spec:
      restartPolicy: Never
      serviceAccountName: gitea-vault
      # fsGroup would recursively loosen Gitea's OpenSSH key permissions on this shared PVC.
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: gitea
              topologyKey: kubernetes.io/hostname
      nodeSelector:
        node-role.kubernetes.io/worker: "true"
        hardware: rpi5
      initContainers:
        - name: python-runtime
          image: python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df
          command: [/bin/sh, -ec]
          args: ["cp -R /usr/local/. /python/"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
          volumeMounts:
            - {name: python-runtime, mountPath: /python}
      containers:
        - name: bootstrap
          image: gitea/gitea:1.23
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - /opt/bootstrap/gitea_atlas_identity_ensure.sh
          env:
            - name: HOME
              value: /data/git
            - name: USER
              value: git
            - name: GITEA_WORK_DIR
              value: /data/gitea
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_API_URL
              value: http://gitea.gitea.svc.cluster.local:3000/api/v1
            - name: GITEA_PUBLIC_URL
              value: https://scm.bstein.dev
            - name: GITEA_SOURCE_OWNER
              value: bstein
            - name: GITEA_MANAGED_REPOSITORIES
              value: hermes-code-demo cassandra soteria pegasus metis ananke ariadne typhon atlas-iac
            - name: VAULT_ADDR
              value: http://vault.vault.svc.cluster.local:8200
            - name: VAULT_ROLE
              value: gitea
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: data
              mountPath: /data
            - name: bootstrap
              mountPath: /opt/bootstrap
              readOnly: true
            - {name: python-runtime, mountPath: /opt/python, readOnly: true}
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: gitea-data
        - name: bootstrap
          configMap:
            name: gitea-atlas-identity-bootstrap
            defaultMode: 0555
        - name: python-runtime
          emptyDir:
            sizeLimit: 128Mi