apiVersion: batch/v1
kind: CronJob
metadata:
  name: kc-sync-users
  namespace: django
spec:
  schedule: "*/10 * * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 540
      ttlSecondsAfterFinished: 3600
      template:
        metadata:
          annotations:
            sidecar.istio.io/inject: "false"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/auth-path: auth/kubernetes
            vault.hashicorp.com/role: django
            vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
            vault.hashicorp.com/agent-inject-template-django-postgresql: |-
              {{- with secret "secrets/data/apps/django/postgres" -}}
              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
              DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
            vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
              {{ index .Data.data "private_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
            vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
              {{ index .Data.data "public_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-kc-admin: secrets/data/camunda/keycloak-admin
            vault.hashicorp.com/agent-inject-template-kc-admin: |-
              {{- with secret "secrets/data/camunda/keycloak-admin" -}}
              {{ index .Data.data "admin-password" }}
              {{- end -}}
        spec:
          serviceAccountName: django-vault
          automountServiceAccountToken: true
          restartPolicy: Never
          imagePullSecrets:
            - name: regcred
          containers:
            - name: kc-sync
              image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
              imagePullPolicy: IfNotPresent
              workingDir: /opt/sarex
              command: ["/bin/sh", "-ec"]
              args:
                - |
                  exec python manage.py synchronization_keycloak --username "$KC_ADMIN_USERNAME" --password "$(cat /vault/secrets/kc-admin)" --sync-users-def-company-id 1
              env:
                - name: DJANGO_SETTINGS_MODULE
                  value: config.settings.kc_sync
                - name: DJANGO_HOST
                  value: https://sarex.local.uralkali.com
                - name: ISOLATED
                  value: "1"
                - name: KC_ADMIN_USERNAME
                  value: admin
                - name: KC_BASE_URL
                  value: http://camunda-keycloak.camunda.svc.cluster.local/auth
                - name: KC_REALM
                  value: master
                - name: KC_STAFF
                  value: GL_sarex-staff
                - name: KC_SUPERUSER
                  value: GL_sarex-admins
                - name: KC_SYNC_ADMIN
                  value: "True"
              resources:
                requests:
                  cpu: 50m
                  memory: 256Mi
              volumeMounts:
                - name: django-configmap
                  mountPath: /opt/sarex/config/settings/production.py
                  subPath: production.py
                  readOnly: true
                - name: kc-sync-configmap
                  mountPath: /opt/sarex/config/settings/kc_sync.py
                  subPath: kc_sync.py
                  readOnly: true
          volumes:
            - name: django-configmap
              configMap:
                name: django-configmap
            - name: kc-sync-configmap
              configMap:
                name: kc-sync-configmap