apiVersion: v1
kind: ServiceAccount
metadata:
  name: mtproxy-link-reconciler
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mtproxy-external-node-reader
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mtproxy-external-node-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mtproxy-external-node-reader
subjects:
  - kind: ServiceAccount
    name: mtproxy-link-reconciler
    namespace: mtproxy
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mtproxy-link-writer
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["mtproxy-links", "telemt-links"]
    verbs: ["get", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mtproxy-link-writer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mtproxy-link-writer
subjects:
  - kind: ServiceAccount
    name: mtproxy-link-reconciler
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: mtproxy-link-reconciler
spec:
  schedule: "*/5 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 2
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          serviceAccountName: mtproxy-link-reconciler
          restartPolicy: OnFailure
          nodeSelector:
            homelab.hexor.cy/exposure: external
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: reconcile
              image: python:3.13-alpine3.22@sha256:e81548ac35b07a3bd4805f275107592ef458b1e893c0e04d45aedaa19416cca5
              command: ["python", "/scripts/reconcile.py"]
              resources:
                requests:
                  cpu: 10m
                  memory: 32Mi
                limits:
                  memory: 128Mi
              securityContext:
                readOnlyRootFilesystem: true
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
              volumeMounts:
                - name: scripts
                  mountPath: /scripts
                  readOnly: true
                - name: config
                  mountPath: /config
                  readOnly: true
          volumes:
            - name: scripts
              configMap:
                name: mtproxy-link-reconciler
            - name: config
              secret:
                secretName: mtproxy-config
                items:
                  - key: SECRET
                    path: SECRET