---
# TEMPORARY: emit a one-hour ServiceAccount kubeconfig into this Job's logs.
# Argo CD's authenticated log API lets the administrator capture it directly
# into a mode-0600 local file without committing the credential to Git.
apiVersion: batch/v1
kind: Job
metadata:
  name: emit-recovery-kubeconfig
  namespace: credential-recovery
spec:
  backoffLimit: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: credential-recovery
    spec:
      restartPolicy: Never
      serviceAccountName: credential-recovery
      containers:
        - name: emit-kubeconfig
          image: busybox:1.37.0
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -eu
            - -c
            - |
              serviceaccount_dir=/var/run/secrets/kubernetes.io/serviceaccount
              ca_data="$(base64 "$serviceaccount_dir/ca.crt" | tr -d '\n')"
              token="$(cat "$serviceaccount_dir/token")"
              cat <<EOF
              apiVersion: v1
              kind: Config
              clusters:
                - name: gitops-starter
                  cluster:
                    server: https://10.10.10.210:6443
                    certificate-authority-data: ${ca_data}
              contexts:
                - name: recovery-admin@gitops-starter
                  context:
                    cluster: gitops-starter
                    user: recovery-admin
              current-context: recovery-admin@gitops-starter
              users:
                - name: recovery-admin
                  user:
                    token: ${token}
              EOF
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 32Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65534
            seccompProfile:
              type: RuntimeDefault