cozystack/packages/apps/postgres/templates/init-job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-init-job
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": before-hook-creation
spec:
  template:
    metadata:
      name: {{ .Release.Name }}-init-job
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/init-script.yaml") . | sha256sum }}
    spec:
      restartPolicy: Never
      containers:
      - name: postgres
        image: ghcr.io/cloudnative-pg/postgresql:15.3
        command:
        - bash
        - /scripts/init.sh
        env:
        - name: PGUSER
          valueFrom:
            secretKeyRef:
              name: {{ .Release.Name }}-superuser
              key: username
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ .Release.Name }}-superuser
              key: password
        - name: PGHOST
          value: {{ .Release.Name }}-rw
        - name: PGPORT
          value: "5432"
        - name: PGDATABASE
          value: postgres
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        volumeMounts:
        - mountPath: /etc/secret
          name: secret
        - mountPath: /scripts
          name: scripts
        {{- include "postgresjobs.resources" . | nindent 8 }}
      securityContext:
        fsGroup: 26
        runAsGroup: 26
        runAsNonRoot: true
        runAsUser: 26
        seccompProfile:
          type: RuntimeDefault
      volumes:
      - name: secret
        secret:
          secretName: {{ .Release.Name }}-superuser
      - name: scripts
        secret:
          secretName: {{ .Release.Name }}-init-script