apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-verify
  namespace: backup-system
spec:
  # Diario desde 2026-07-15 (el sync a Mega ya es diario; ventana de frescura 3 días)
  schedule: "0 5 * * *"
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          nodeSelector:
            kubernetes.io/hostname: chemavx-k8
          restartPolicy: OnFailure
          securityContext:
            runAsUser: 0
          containers:
            - name: verify
              # OJO: imagen BusyBox — verify.sh debe evitar GNU-ismos (date -d 'yesterday')
              image: docker.io/rclone/rclone:1.74.3
              command: ["/bin/sh", "/scripts/verify.sh"]
              resources:
                limits:
                  cpu: 200m
                  memory: 256Mi
                requests:
                  cpu: 50m
                  memory: 64Mi
              volumeMounts:
                - mountPath: /rclone
                  name: rclone-conf
                - mountPath: /scripts
                  name: scripts
          volumes:
            # rclone-conf-b2: secret out-of-band con mega+b2 (verify comprueba ambos)
            - name: rclone-conf
              secret:
                secretName: rclone-conf-b2
                items:
                  - key: RCLONE_CONF
                    path: rclone.conf
            - name: scripts
              configMap:
                name: backup-scripts
                defaultMode: 0755