{{- if .Values.featureFlags.invalidateCache }}
# Ensure db indexes are set and invalidate the chart when upgrading.
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kubeapps.apprepository-job-postupgrade.fullname" . }}
  annotations:
    helm.sh/hook: post-upgrade
    helm.sh/hook-weight: "0"
    helm.sh/hook-delete-policy: hook-succeeded
  labels:{{ include "kubeapps.extraAppLabels" . | nindent 4 }}
    app: {{ template "kubeapps.apprepository-job-postupgrade.fullname" . }}
spec:
  template:
    metadata:
      labels:
        app: {{ template "kubeapps.apprepository-job-postupgrade.fullname" . }}
        app.kubernetes.io/name: {{ template "kubeapps.name" . }}
        release: {{ .Release.Name }}
        app.kubernetes.io/instance: {{ .Release.Name }}
    spec:
{{- include "kubeapps.imagePullSecrets" . | indent 6 }}
      {{- if .Values.hooks.affinity }}
      affinity: {{- include "kubeapps.tplValue" (dict "value" .Values.hooks.affinity "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.hooks.nodeSelector }}
      nodeSelector: {{- include "kubeapps.tplValue" (dict "value" .Values.hooks.nodeSelector "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.hooks.tolerations }}
      tolerations: {{- include "kubeapps.tplValue" (dict "value" .Values.hooks.tolerations "context" $) | nindent 8 }}
      {{- end }}
      {{- if .Values.securityContext.enabled }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
        runAsUser: {{ .Values.securityContext.runAsUser }}
      {{- end }}
      restartPolicy: OnFailure
      serviceAccountName: {{ template "kubeapps.apprepository-job-postupgrade.fullname" . }}
      containers:
        - name: invalidate-cache
          image: {{ template "kubeapps.image" (list .Values.apprepository.syncImage .Values.global) }}
          imagePullPolicy: {{ .Values.apprepository.syncImage.pullPolicy | quote }}
          command:
            - /asset-syncer
          args:
            - invalidate-cache
            - --database-url={{ template "kubeapps.postgresql.fullname" . }}:5432
            - --database-user=postgres
            - --database-name=assets
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: postgresql-password
                  name: {{ .Values.postgresql.existingSecret }}
      {{- if .Values.postgresql.existingSecret }}
      initContainers:
        # Helm 3.1 supports a lookup template tag to create a secret if it does not exist
        # but we can't yet restrict to helm 3.1, hence manually doing this with an initContainer.
        - name: ensure-postgres-password
          image: {{ template "kubeapps.image" (list .Values.hooks.image .Values.global) }}
          imagePullPolicy: {{ .Values.hooks.image.pullPolicy | quote }}
          command:
            - /bin/bash
          args:
            - -c
            - 'kubectl -n {{ .Release.Namespace }} get secret {{ .Values.postgresql.existingSecret }} || kubectl -n {{ .Release.Namespace }} create secret generic {{ .Values.postgresql.existingSecret }} --from-literal=postgresql-password={{ randAlphaNum 10 | quote }} --from-literal=postgresql-replication-password={{ randAlphaNum 10 | quote }}'
      {{- end }}
{{- end }}
