{{- if (.Values.tidb.passwordSecretName) or (.Values.tidb.initSql) }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "cluster.name" . }}-tidb-initializer
  annotations:
    "helm.sh/hook": post-install
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ template "cluster.name" . }}
    app.kubernetes.io/component: tidb-initializer
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
spec:
  backoffLimit: 1000
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ template "chart.name" . }}
        app.kubernetes.io/instance: {{ template "cluster.name" . }}
        app.kubernetes.io/component: tidb-initializer
    spec:
      restartPolicy: OnFailure
      containers:
      - name: mysql-client
        image: {{ .Values.mysqlClient.image }}
        imagePullPolicy: {{ .Values.mysqlClient.imagePullPolicy | default "IfNotPresent" }}
        command:
        - python
        - -c
        - |
{{ tuple "scripts/_initialize_tidb_users.py.tpl" . | include "helm-toolkit.utils.template" | indent 10 }}
        volumeMounts:
        - name: password
          mountPath: /etc/tidb/password
          readOnly: true
        {{- if .Values.tidb.initSql }}
        - name: init-sql
          mountPath: /data
          readOnly: true
        {{- end }}
      volumes:
      - name: password
        secret:
          secretName: {{ .Values.tidb.passwordSecretName }}
      {{- if .Values.tidb.initSql }}
      - name: init-sql
        configMap:
          {{- if .Values.enableConfigMapRollout }}
          name: {{ template "cluster.name" . }}-tidb-{{ template "tidb-configmap.data-digest" . }}
          {{- else }}
          name: {{ template "cluster.name" . }}-tidb
          {{- end }}
          items:
          - key: init-sql
            path: init.sql
      {{- end }}
{{- end }}