{{/*
Copyright 2017 AT&T Intellectual Property.  All other rights reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}
{{- if .Values.manifests.cron_etcd_backup }}
{{- $envAll := . }}
{{- $serviceAccountName := "etcd-backup" }}
{{- $applicationName := "etcd-backup" }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: {{ $serviceAccountName }}
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    component: etcd-backup
  name: {{ $serviceAccountName }}
  namespace: {{ $envAll.Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: {{ $serviceAccountName }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $serviceAccountName }}
subjects:
  - kind: ServiceAccount
    name: {{ $serviceAccountName }}
    namespace: {{ $envAll.Release.Namespace }}
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: etcd-backup
spec:
  schedule: {{ .Values.jobs.etcd_backup.cron | quote }}
  successfulJobsHistoryLimit: {{ .Values.jobs.etcd_backup.history.success }}
  failedJobsHistoryLimit: {{ .Values.jobs.etcd_backup.history.failed }}
  concurrencyPolicy: Forbid
  jobTemplate:
    metadata:
      labels:
{{ tuple $envAll $applicationName "etcd-anchor" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
    spec:
      template:
        spec:
          serviceAccountName: {{ $serviceAccountName }}
          restartPolicy: OnFailure
          nodeSelector:
            {{ .Values.labels.anchor.node_selector_key }}: {{ .Values.labels.anchor.node_selector_value }}
          containers:
            - name: etcd-backup
              image: {{ .Values.images.tags.etcdctl }}
              imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.etcd_backup | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
              env:
                - name: ETCDCTL_API
                  value: '3'
                - name: ETCDCTL_DIAL_TIMEOUT
                  value: {{ .Values.backup.etcdctl_dial_timeout }}
                - name: ETCDCTL_ENDPOINTS
                  value: https://{{ .Values.anchor.etcdctl_endpoint }}:{{ .Values.network.service_client.port }}
                - name: ETCDCTL_CACERT
                  value: /etc/etcd/tls/certs/client-ca.pem
                - name: ETCDCTL_CERT
                  value: /etc/etcd/tls/certs/anchor-etcd-client.pem
                - name: ETCDCTL_KEY
                  value: /etc/etcd/tls/keys/anchor-etcd-client-key.pem
                - name: CLIENT_ENDPOINT
                  value: https://$(POD_IP):{{ .Values.network.service_client.target_port }}
                - name: PEER_ENDPOINT
                  value: https://$(POD_IP):{{ .Values.network.service_peer.target_port }}
              command:
                - /tmp/bin/etcdbackup
              volumeMounts:
                - name: {{ .Values.service.name }}-bin
                  mountPath: /tmp/bin
                - name: {{ .Values.service.name }}-certs
                  mountPath: /etc/etcd/tls/certs
                - name: {{ .Values.service.name }}-keys
                  mountPath: /etc/etcd/tls/keys
                - name: etcd-backup
                  mountPath: /var/lib/etcd/backup
          volumes:
          - name: {{ .Values.service.name }}-bin
            configMap:
              name: {{ .Values.service.name }}-bin
              defaultMode: 0555
          - name: {{ .Values.service.name }}-certs
            configMap:
              name: {{ .Values.service.name }}-certs
              defaultMode: 0444
          - name: etcd-backup
            hostPath:
              path: {{ .Values.backup.host_backup_path }}
          - name: {{ .Values.service.name }}-keys
            secret:
              secretName: {{ .Values.service.name }}-keys
              defaultMode: 0444
{{- end }}