{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}

{{- if .Values.backup.enabled }}
apiVersion: {{ include "common.capabilities.cronjob.apiVersion" . }}
kind: CronJob
metadata:
  name: "{{ template "common.names.fullname" . }}-backup"
  namespace: {{ include "common.names.namespace" . | quote }}
  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
  {{- if .Values.commonAnnotations }}
  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
  {{- end }}
spec:
  schedule: {{ .Values.backup.cronjob.schedule | quote }}
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: {{ .Values.backup.cronjob.historyLimit }}
  failedJobsHistoryLimit: {{ .Values.backup.cronjob.historyLimit }}
  jobTemplate:
    spec:
      template:
        metadata:
          labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 12 }}
          {{- if .Values.backup.cronjob.podAnnotations }}
          annotations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.podAnnotations "context" $) | nindent 12 }}
          {{- end }}
        spec:
          {{- if .Values.backup.cronjob.podSecurityContext.enabled }}
          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.podSecurityContext "context" $) | nindent 12 }}
          {{- end }}
          {{- include "influxdb.imagePullSecrets" . | nindent 10 }}
          serviceAccountName: {{ include "influxdb.serviceAccountName" . }}
          restartPolicy: OnFailure
          volumes:
            - name: empty-dir
              emptyDir: {}
            - name: backup-scripts
              configMap:
                name: {{ include "common.names.fullname" . }}-backup
                defaultMode: 0755
            {{- if .Values.auth.usePasswordFiles }}
            - name: influxdb-credentials
              secret:
                secretName: {{ include "influxdb.secretName" . }}
            {{- end }}
            {{- if .Values.auth.usePasswordFiles }}
            - name: backup-credentials
              secret:
                secretName: {{ include "influxdb.backup.secretName" . }}
            {{- end }}
            {{- if .Values.backup.cronjob.caBundle.enabled }}
            - name: ca-bundle
              configMap:
                name: {{ .Values.backup.cronjob.caBundle.existingConfigMap }}
            {{- end }}
            {{- if .Values.backup.uploadProviders.google.enabled }}
            - name: google-cloud-key
              secret:
            {{- if .Values.backup.uploadProviders.google.existingSecret }}
                secretName: {{ .Values.backup.uploadProviders.google.existingSecret | quote }}
            {{- else }}
                secretName: {{ include "common.names.fullname" . }}-backup-gcloud
            {{- end }}
            {{- end }}
            - name: {{ include "common.names.fullname" . }}-backups
            {{- if ternary .Values.backup.persistence.enabled .Values.persistence.enabled .Values.backup.persistence.ownConfig }}
              persistentVolumeClaim:
                claimName: {{ include "influxdb.backup.claimName" . }}
            {{- else }}
              emptyDir: {}
            {{- end }}
          {{- if .Values.backup.affinity }}
          affinity: {{- include "common.tplvalues.render" (dict "value" .Values.backup.affinity "context" $) | nindent 12 }}
          {{- else }}
          affinity:
            podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backup.podAffinityPreset "component" "influxdb" "customLabels" .Values.commonLabels "context" $) | nindent 14 }}
            podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backup.podAntiAffinityPreset "component" "influxdb" "customLabels" .Values.commonLabels "context" $) | nindent 14 }}
            nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backup.nodeAffinityPreset.type "key" .Values.backup.nodeAffinityPreset.key "values" .Values.backup.nodeAffinityPreset.values) | nindent 14 }}
          {{- end }}
          {{- if .Values.backup.nodeSelector }}
          nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.nodeSelector "context" $) | nindent 12 }}
          {{- end }}
          {{- if .Values.backup.tolerations }}
          tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.tolerations "context" $) | nindent 10 }}
          {{- end }}
          initContainers:
            - name: influxdb-backup
              image: {{ include "influxdb.image" . | quote }}
              env:
                {{- if .Values.auth.usePasswordFiles }}
                - name: INFLUXDB_ADMIN_USER_PASSWORD_FILE
                  value: "/opt/bitnami/influxdb/secrets/admin-user-password"
                - name: INFLUXDB_ADMIN_USER_TOKEN_FILE
                  value: "/opt/bitnami/influxdb/secrets/admin-user-token"
                {{- else }}
                - name: INFLUXDB_ADMIN_USER_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "influxdb.secretName" . }}
                      key: admin-user-password
                - name: INFLUXDB_ADMIN_USER_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "influxdb.secretName" . }}
                      key: admin-user-token
                {{- end }}
              command:
                - "/tmp/backup.sh"
              {{- if .Values.backup.cronjob.resources }}
              resources: {{- toYaml .Values.backup.cronjob.resources | nindent 16 }}
              {{- else if ne .Values.backup.cronjob.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 16 }}
              {{- end }}
              volumeMounts:
                - name: empty-dir
                  mountPath: /tmp
                  subPath: tmp-dir
                - name: {{ include "common.names.fullname" . }}-backups
                  mountPath: {{ .Values.backup.directory | quote }}
                - name: backup-scripts
                  mountPath: /tmp/backup.sh
                  subPath: backup.sh
                {{- if  .Values.auth.usePasswordFiles }}
                - name: influxdb-credentials
                  mountPath: /opt/bitnami/influxdb/secrets/
                {{- end }}
              {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
          containers:
            - name: influxdb-backup-dummy-container
              image: {{ include "influxdb.image" . | quote }}
              {{- if .Values.diagnosticMode.enabled }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 16 }}
              args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 16 }}
              {{- else }}
              command:
                - "/bin/true"
              {{- end }}
              {{- if .Values.backup.cronjob.resources }}
              resources: {{- toYaml .Values.backup.cronjob.resources | nindent 16 }}
              {{- else if ne .Values.backup.cronjob.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 16 }}
              {{- end }}
              {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
            {{- if .Values.backup.uploadProviders.google.enabled }}
            - name: gsutil-cp
              image: {{ include "gcloudSdk.image" . }}
              {{- if .Values.diagnosticMode.enabled }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 16 }}
              args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 16 }}
              {{- else }}
              command:
                - "/tmp/upload-google.sh"
              {{- end }}
              {{- if .Values.backup.uploadProviders.google.resources }}
              resources: {{- toYaml .Values.backup.uploadProviders.google.resources | nindent 16 }}
              {{- else if ne .Values.backup.uploadProviders.google.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.backup.uploadProviders.google.resourcesPreset) | nindent 16 }}
              {{- end }}
              volumeMounts:
                - name: empty-dir
                  mountPath: /tmp
                  subPath: tmp-dir
                - name: {{ include "common.names.fullname" . }}-backups
                  mountPath: {{ .Values.backup.directory | quote }}
                - name: backup-scripts
                  mountPath: /tmp/upload-google.sh
                  subPath: upload-google.sh
                - name: google-cloud-key
                  mountPath: /var/secrets/google/
                {{- if .Values.backup.cronjob.caBundle.enabled }}
                - name: ca-bundle
                  mountPath: {{ .Values.backup.cronjob.caBundle.mountPath }}
                  subPath: {{ .Values.backup.cronjob.caBundle.subPath }}
                {{- end }}
              {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
            {{- end }}
            {{- if .Values.backup.uploadProviders.azure.enabled }}
            - name: azure-cli
              image: {{ include "azureCli.image" . }}
              {{- if .Values.diagnosticMode.enabled }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 16 }}
              args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 16 }}
              {{- else }}
              command:
              - "/tmp/upload-azure.sh"
              {{- end }}
              {{- if .Values.backup.uploadProviders.azure.resources }}
              resources: {{- toYaml .Values.backup.uploadProviders.azure.resources | nindent 16 }}
              {{- else if ne .Values.backup.uploadProviders.azure.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.backup.uploadProviders.azure.resourcesPreset) | nindent 16 }}
              {{- end }}
              env:
                - name: AZURE_STORAGE_CONNECTION_STRING
                  valueFrom:
                    secretKeyRef:
                      {{- if .Values.backup.uploadProviders.azure.existingSecret }}
                      name: {{ .Values.backup.uploadProviders.azure.existingSecret | quote }}
                      {{- else }}
                      name: {{ include "common.names.fullname" . }}-backup-azure
                      {{- end }}
                      key: {{ .Values.backup.uploadProviders.azure.secretKey }}
              volumeMounts:
                - name: empty-dir
                  mountPath: /tmp
                  subPath: tmp-dir
                - name: {{ include "common.names.fullname" . }}-backups
                  mountPath: {{ .Values.backup.directory | quote }}
                - name: backup-scripts
                  mountPath: /tmp/upload-azure.sh
                  subPath: upload-azure.sh
                {{- if .Values.backup.cronjob.caBundle.enabled }}
                - name: ca-bundle
                  mountPath: {{ .Values.backup.cronjob.caBundle.mountPath }}
                  subPath: {{ .Values.backup.cronjob.caBundle.subPath }}
                {{- end }}
              {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
            {{- end }}
            {{- if .Values.backup.uploadProviders.aws.enabled }}
            - name: aws-cli
              image: {{ include "awsCli.image" . }}
              {{- if .Values.diagnosticMode.enabled }}
              command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 16 }}
              args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 16 }}
              {{- else }}
              command:
                - |
                  {{- if .Values.backup.uploadProviders.aws.usePasswordFiles }}
                  export AWS_ACCESS_KEY_ID="$(< $AWS_ACCESS_KEY_ID_FILE)"
                  export AWS_SECRET_ACCESS_KEY="$(< $AWS_SECRET_ACCESS_KEY_FILE)"
                  export AWS_DEFAULT_REGION="$(< $AWS_DEFAULT_REGION_FILE)"
                  export AWS_ENDPOINT_URL_S3="$(< $AWS_ENDPOINT_URL_S3_FILE)"
                  {{- end }}
                  "/tmp/upload-aws.sh"
              {{- end }}
              {{- if .Values.backup.uploadProviders.aws.resources }}
              resources: {{- toYaml .Values.backup.uploadProviders.aws.resources | nindent 16 }}
              {{- else if ne .Values.backup.uploadProviders.aws.resourcesPreset "none" }}
              resources: {{- include "common.resources.preset" (dict "type" .Values.backup.uploadProviders.aws.resourcesPreset) | nindent 16 }}
              {{- end }}
              env:
                {{- if .Values.backup.uploadProviders.aws.usePasswordFiles }}
                - name: AWS_ACCESS_KEY_ID_FILE
                  value: "/secrets/accessKeyID"
                - name: AWS_SECRET_ACCESS_KEY_FILE
                  value: "/secrets/secretAccessKey"
                - name: AWS_DEFAULT_REGION_FILE
                  value: "/secrets/region"
                - name: AWS_ENDPOINT_URL_S3_FILE
                  value: "/secrets/endpoint"
                {{- else }}
                - name: AWS_ACCESS_KEY_ID
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "infuxdb.backup.secretName" .}}
                      key: accessKeyID
                - name: AWS_SECRET_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "infuxdb.backup.secretName" .}}
                      key: secretAccessKey
                - name: AWS_DEFAULT_REGION
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "infuxdb.backup.secretName" .}}
                      key: region
                - name: AWS_ENDPOINT_URL_S3
                  valueFrom:
                    secretKeyRef:
                      name: {{ include "infuxdb.backup.secretName" .}}
                      key: endpoint
                {{- end }}
                {{- if .Values.backup.cronjob.caBundle.enabled }}
                - name: AWS_CA_BUNDLE
                  value: {{ .Values.backup.cronjob.caBundle.mountPath }}
                {{- end }}
              volumeMounts:
                - name: empty-dir
                  mountPath: /tmp
                  subPath: tmp-dir
                - name: empty-dir
                  mountPath: /.aws
                  subPath: aws-dir
                - name: {{ include "common.names.fullname" . }}-backups
                  mountPath: {{ .Values.backup.directory | quote }}
                - name: backup-scripts
                  mountPath: /tmp/upload-aws.sh
                  subPath: upload-aws.sh
                {{- if .Values.backup.uploadProviders.aws.usePasswordFiles }}
                - name: backup-credentials
                  mountPath: /secrets
                {{- end }}
                {{- if .Values.backup.cronjob.caBundle.enabled }}
                - name: ca-bundle
                  mountPath: {{ .Values.backup.cronjob.caBundle.mountPath }}
                  subPath: {{ .Values.backup.cronjob.caBundle.subPath }}
                {{- end }}
              {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
              securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 16 }}
              {{- end }}
            {{- end }}
{{- end }}
