apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-flux-check"
  labels:
    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
    app.kubernetes.io/part-of: flux
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 1
  template:
    metadata:
      name: "{{ .Release.Name }}"
      {{- with .Values.cli.annotations }}
      annotations: {{ toYaml . | nindent 8 }}
      {{- end }}
      labels:
        app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
        app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
        app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
        app.kubernetes.io/part-of: flux
        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    spec:
      restartPolicy: Never
      serviceAccountName: "{{ .Release.Name }}-flux-check"
      automountServiceAccountToken: {{ .Values.cli.serviceAccount.automount }}
      containers:
      - name: flux-cli
        image: {{ template "template.image" .Values.cli }}
        command: ["/usr/local/bin/flux", "check",  "--pre", "--namespace", {{ .Release.Namespace }}]
        {{- with .Values.cli.resources }}
        resources: {{ toYaml . | nindent 10 }}
        {{- end }}
        {{- if .Values.cli.securityContext }}
        securityContext: {{ toYaml .Values.cli.securityContext | nindent 10 }}
        {{- else }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        {{- end}}
        {{- if .Values.cli.volumeMounts }}
        volumeMounts:
        {{- toYaml .Values.cli.volumeMounts | nindent 10 }}
        {{- end}}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 6 }}
      {{- end }}
      {{- with .Values.cli.nodeSelector }}
      nodeSelector: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.cli.volumes }}
      volumes:
      {{- toYaml .Values.cli.volumes | nindent 8 }}
      {{- end}}
      {{- with .Values.cli.affinity }}
      affinity: {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.cli.tolerations }}
      tolerations: {{ toYaml . | nindent 8 }}
      {{- end }}
