apiVersion: batch/v1
kind: CronJob
metadata:
  name: cloudflare-ddns
  namespace: cloudflare-ddns
spec:
  schedule: "*/5 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  startingDeadlineSeconds: 300
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: ddns
              image: python:3.12-alpine
              command: ["python3", "/script/ddns.py"]
              env:
                - name: CF_ZONE
                  value: aleshym.co
                - name: CF_RECORD
                  value: aleshym.co
                - name: CF_API_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: cloudflare-ddns-token
                      key: api-token
              volumeMounts:
                - name: script
                  mountPath: /script
                  readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: ["ALL"]
              resources:
                requests:
                  cpu: 10m
                  memory: 32Mi
                limits:
                  memory: 64Mi
          volumes:
            - name: script
              configMap:
                name: cloudflare-ddns-script