apiVersion: batch/v1
kind: Job
metadata:
  labels:
    {{- include "etcd.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-weight": "10"
    "helm.sh/hook-delete-policy": "hook-succeeded,before-hook-creation,hook-failed"
  name: "{{ .Release.Name }}-etcd-setup-2"
  namespace: {{ .Release.Namespace }}
spec:
  backoffLimit: 12
  template:
    metadata:
      name: "{{ .Release.Name }}"
    spec:
      serviceAccountName: {{ include "etcd.serviceAccountName" . }}
      restartPolicy: Never
      initContainers:
        - name: kubectl
          image: {{ printf "clastix/kubectl:%s" (include "etcd.jobsTagKubeVersion" .) }}
          command:
          - sh
          - -c
          - kubectl --namespace={{ .Release.Namespace }} rollout status sts/{{ include "etcd.stsName" . }} --timeout=300s
      containers:
        - command:
          - bash
          - -c
          - |-
            etcdctl member list -w table
            if etcdctl user get root &>/dev/null; then
              echo "User already exists, nothing to do"
            else
              etcdctl user add --no-password=true root &&
              etcdctl role add root &&
              etcdctl user grant-role root root &&
              etcdctl auth enable
            fi
          env:
            - name: ETCDCTL_ENDPOINTS
              value: https://{{ include "etcd.fullname" . }}-0.{{ include "etcd.serviceName" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.clientPort }}
            - name: ETCDCTL_CACERT
              value: /opt/certs/ca/ca.crt
            - name: ETCDCTL_CERT
              value: /opt/certs/root-certs/tls.crt
            - name: ETCDCTL_KEY
              value: /opt/certs/root-certs/tls.key
          image: {{ include "etcd.fullyQualifiedDockerImage" . }}
          imagePullPolicy: IfNotPresent
          name: etcd-client
          volumeMounts:
            - name: root-certs
              mountPath: /opt/certs/root-certs
            - name: ca
              mountPath: /opt/certs/ca
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      {{- with .Values.tolerations }}
      tolerations: {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: root-certs
          secret:
            secretName: {{ include "etcd.clientSecretName" . }}
        - name: ca
          secret:
            secretName: {{ include "etcd.caSecretName" . }}
