---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: cost-optimization
  name: cleanups
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cleanups
  namespace: cost-optimization
subjects:
  - kind: ServiceAccount
    name: cleanups
    namespace: cost-optimization
roleRef:
  kind: Role
  name: cleanups
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cleanups
  namespace: cost-optimization
rules:
  - apiGroups: [""]
    resources: ["pods","secrets", "namespaces"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["pingcap.com"]
    resources: ["tidbclusters"]
    verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cleanups
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cleanups
    namespace: cost-optimization

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cleanups
  namespace: cost-optimization
---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: nightly-tidb-cleanups
  namespace: cost-optimization
spec:
  # execute once every 10 minutes
  schedule: "*/10  * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: cleanups
          containers:
            - name: cleanups
              image: 385595570414.dkr.ecr.us-west-2.amazonaws.com/cost-optimization:latest
              imagePullPolicy: Always
              args: ['/usr/bin/python3', 'auto_cleanup.py']
              env:
                - name: environment
                  value: "nightly"
                - name: config-path
                  value: /cost/nightly-config.yaml
              volumeMounts:
                - name: config-volume
                  mountPath: /cost
          volumes:
            - name: config-volume
              configMap:
                name: nightly-auto-cleanup-configmap
          restartPolicy: OnFailure