iac/kubernetes/core/crd-schema-publisher/cronjob.yml at 874da8fb5168c99d5576c31e20a41d7ed43ced7b · chkpwd/iac · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/refs/heads/master/v1.34.0/cronjob-batch-v1.json
apiVersion: batch/v1
kind: CronJob
metadata:
  name: crd-schema-publisher
  namespace: crd-schema-publisher
spec:
  schedule: "30 10 * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      activeDeadlineSeconds: 1800
      template:
        spec:
          serviceAccountName: crd-schema-publisher
          restartPolicy: OnFailure
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            fsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: crd-schema-publisher
              image: ghcr.io/sholdee/crd-schema-publisher:v2026.721.161952
              args: ["extract"]
              env:
                - name: OUTPUT_DIR
                  value: /output
                - name: BASE_PATH
                  value: "/iac"
              resources:
                requests:
                  cpu: 50m
                  memory: 1Gi
                limits:
                  cpu: 500m
                  memory: 1Gi
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              volumeMounts:
                - name: output
                  mountPath: /output
            - name: git-push
              image: alpine/git:v2.54.0
              command: ["/bin/sh", "-c"]
              args:
                - |
                  while [ ! -f /data/current/index.html ]; do sleep 5; done
                  echo "Publisher complete, starting git sync"

                  git config --global user.name "crd-schema-publisher"
                  git config --global user.email "crd-schema-publisher@users.noreply.github.com"
                  git config --global --add safe.directory /repo

                  if [ -z "$(ls -A /repo)" ]; then
                    git clone --branch "${GIT_BRANCH}" --single-branch \
                      "https://x-access-token:${GITHUB_TOKEN}@github.com/${GIT_REPO}.git" /repo || {
                      git init /repo
                      cd /repo
                      git checkout -b "${GIT_BRANCH}"
                      git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GIT_REPO}.git"
                    }
                  fi

                  cd /repo

                  cp -r /data/current/. /repo/

                  git add -A
                  if ! git diff --cached --quiet; then
                    git commit -m "update schemas $(date -u +%Y-%m-%dT%H:%M:%SZ)"
                    git push origin "${GIT_BRANCH}"
                    echo "Schemas pushed successfully"
                  else
                    echo "No changes to push"
                  fi
              env:
                - name: GITHUB_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: crd-schema-publisher-git-push
                      key: github-token
                - name: GIT_REPO
                  valueFrom:
                    secretKeyRef:
                      name: crd-schema-publisher-git-push
                      key: github-repo
                - name: GIT_BRANCH
                  value: "gh-pages"
                - name: HOME
                  value: "/home/git"
              resources:
                requests:
                  cpu: 10m
                  memory: 64Mi
                limits:
                  memory: 256Mi
              securityContext:
                runAsUser: 1000
                runAsNonRoot: true
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: ["ALL"]
              volumeMounts:
                - name: output
                  mountPath: /data
                  readOnly: true
                - name: git-workspace
                  mountPath: /repo
                - name: git-home
                  mountPath: /home/git
                - name: git-tmp
                  mountPath: /tmp
          volumes:
            - name: output
              emptyDir: {}
            - name: git-workspace
              emptyDir: {}
            - name: git-home
              emptyDir: {}
            - name: git-tmp
              emptyDir: {}