apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
  namespace: backup-system
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      # Sin reintentos automáticos: un reintento re-crea TODOS los artefactos con
      # otro timestamp y la retención por número podría expulsar copias buenas.
      backoffLimit: 1
      activeDeadlineSeconds: 3600
      template:
        spec:
          restartPolicy: Never
          serviceAccountName: backup-sa
          securityContext:
            runAsUser: 0
          nodeSelector:
            kubernetes.io/hostname: chemavx-k8
          containers:
          - name: backup
            # bitnami/kubectl v1.36.2 — pinneado por digest: los tags de bitnami
            # en Docker Hub ya no son fiables (migración Broadcom/bitnamilegacy)
            image: docker.io/bitnami/kubectl@sha256:558420daf32bbc382e3e9af4537f4073085b336ddd47399a3b70e70087115978
            command: ["/bin/bash", "/scripts/backup.sh"]
            env:
            - name: KUBECONFIG
              value: /kubeconfig/k3s.yaml
            resources:
              requests:
                cpu: 200m
                memory: 256Mi
              limits:
                cpu: "1"
                memory: 1Gi
            volumeMounts:
            - name: backup-dir
              mountPath: /data/backups/backups
            - name: n8n-data
              mountPath: /data/n8n
            - name: openclaw-data
              mountPath: /data/openclaw
            - name: scripts
              mountPath: /scripts
            - name: k3s-storage
              mountPath: /var/lib/rancher/k3s/storage
            - name: kubeconfig
              mountPath: /kubeconfig/k3s.yaml
            - name: k3s-db
              mountPath: /data/k3s-db
              readOnly: true
            - name: k3s-token
              mountPath: /host/k3s-token
              readOnly: true
            - name: etc-rancher-k3s
              mountPath: /host/etc-rancher-k3s
              readOnly: true
            - name: home-chemavx
              mountPath: /host/home-chemavx
              readOnly: true
          volumes:
          - name: backup-dir
            hostPath:
              path: /data/backups/backups
              type: DirectoryOrCreate
          - name: n8n-data
            hostPath:
              path: /data/n8n
              type: DirectoryOrCreate
          - name: openclaw-data
            hostPath:
              path: /data/openclaw
              type: DirectoryOrCreate
          - name: scripts
            configMap:
              name: backup-scripts
              defaultMode: 0755
          - name: k3s-storage
            hostPath:
              path: /var/lib/rancher/k3s/storage
              type: Directory
          - name: kubeconfig
            hostPath:
              path: /etc/rancher/k3s/k3s.yaml
              type: File
          - name: k3s-db
            hostPath:
              path: /var/lib/rancher/k3s/server/db
              type: Directory
          - name: k3s-token
            hostPath:
              path: /var/lib/rancher/k3s/server/token
              type: File
          - name: etc-rancher-k3s
            hostPath:
              path: /etc/rancher/k3s
              type: Directory
          - name: home-chemavx
            hostPath:
              path: /home/chemavx
              type: Directory