apiVersion: batch/v1
kind: Job
metadata:
  name: upload-oblako-las
  namespace: django
  annotations:
    kustomize.toolkit.fluxcd.io/force: enabled
spec:
  backoffLimit: 1
  activeDeadlineSeconds: 10800
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/auth-path: auth/kubernetes
        vault.hashicorp.com/role: django
        vault.hashicorp.com/agent-inject-secret-minio: secrets/data/minio/apps/django
        vault.hashicorp.com/agent-inject-template-minio: |-
          {{- with secret "secrets/data/minio/apps/django" -}}
          export MINIO_ACCESS_KEY='{{ index .Data.data "access_key" }}'
          export MINIO_SECRET_KEY='{{ index .Data.data "secret_key" }}'
          {{- end -}}
    spec:
      serviceAccountName: django-vault
      automountServiceAccountToken: true
      restartPolicy: Never
      imagePullSecrets:
        - name: regcred
      containers:
        - name: upload
          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
          imagePullPolicy: IfNotPresent
          command: ["/bin/bash", "-euo", "pipefail", "-c"]
          args:
            - |
              log() { echo "$(date -u '+%Y-%m-%dT%H:%M:%SZ') $*"; }
              . /vault/secrets/minio
              F="/work/$OBJECT_NAME"

              log "step 1/5: free space in /work"
              df -h /work
              avail=$(df -Pk /work | awk 'NR==2 {print $4 * 1024}')
              log "available ${avail} bytes, need ${EXPECTED_SIZE}"
              if [ "$avail" -lt "$EXPECTED_SIZE" ]; then
                log "ERROR: not enough space"; exit 1
              fi

              log "step 2/5: download from Yandex Object Storage"
              curl -kfsS --retry 5 --retry-delay 10 -C - -o "$F" "$SOURCE_URL" &
              pid=$!
              while kill -0 "$pid" 2>/dev/null; do
                sleep 15
                size=$(stat -c %s "$F" 2>/dev/null || echo 0)
                log "downloaded ${size} / ${EXPECTED_SIZE} bytes ($((size * 100 / EXPECTED_SIZE))%)"
              done
              wait "$pid" || { log "ERROR: curl failed with code $?"; exit 1; }
              size=$(stat -c %s "$F")
              log "download finished, ${size} bytes"
              if [ "$size" -ne "$EXPECTED_SIZE" ]; then
                log "ERROR: size mismatch"; exit 1
              fi

              log "step 3/5: connect to MinIO ${MINIO_ENDPOINT}"
              mc alias set target "$MINIO_ENDPOINT" "$MINIO_ACCESS_KEY" "$MINIO_SECRET_KEY" >/dev/null
              if ! mc ls "target/$BUCKET" >/dev/null; then
                log "ERROR: bucket $BUCKET is not reachable with django credentials"; exit 1
              fi
              log "bucket $BUCKET is reachable"

              log "step 4/5: upload to $BUCKET/$OBJECT_NAME"
              mc cp --quiet "$F" "target/$BUCKET/$OBJECT_NAME" &
              pid=$!
              while kill -0 "$pid" 2>/dev/null; do
                sleep 30
                log "upload in progress"
              done
              wait "$pid" || { log "ERROR: mc cp failed with code $?"; exit 1; }

              log "step 5/5: verify"
              mc stat "target/$BUCKET/$OBJECT_NAME"
              remote=$(mc stat --json "target/$BUCKET/$OBJECT_NAME" | sed -n 's/.*"size":\([0-9]*\).*/\1/p')
              if [ "$remote" != "$EXPECTED_SIZE" ]; then
                log "ERROR: remote size ${remote} != ${EXPECTED_SIZE}"; exit 1
              fi
              rm -f "$F"
              log "done: $BUCKET/$OBJECT_NAME, ${remote} bytes"
          env:
            - name: SOURCE_URL
              value: "https://storage.yandexcloud.net/documentations-prod-270-dlia-stateisarex/7937275e-967e-452e-b79d-b1991bca1dd4?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=YCAJEOB86NUJTIBSnlwY_OvTI%2F20261105%2Fru-central1%2Fs3%2Faws4_request&X-Amz-Date=20261105T120651Z&X-Amz-Expires=259200&X-Amz-Signature=423bf587fbf89ba6a3b10bda57f37100bfcd72c3a6ba84a3c91eec922364c088&X-Amz-SignedHeaders=host&response-content-disposition=attachment"
            - name: EXPECTED_SIZE
              value: "5488991489"
            - name: MINIO_ENDPOINT
              value: http://10.133.0.245:9000
            - name: BUCKET
              value: django
            - name: OBJECT_NAME
              value: Облако.las
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
              ephemeral-storage: 6Gi
            limits:
              ephemeral-storage: 7Gi
          volumeMounts:
            - name: work
              mountPath: /work
      volumes:
        - name: work
          emptyDir:
            sizeLimit: 7Gi