---
apiVersion: v1
kind: Secret
metadata:
  name: etcd-migration-ca
  namespace: garden
type: Opaque
data:
  # TODO: Change this value and enter your base64-encoded CA certificate for etcd.
  ca.pem: base64(ca-cert)
---
apiVersion: v1
kind: Secret
metadata:
  name: etcd-migration-clientcert
  namespace: garden
type: Opaque
data:
  # TODO: Change this value and enter your base64-encoded client certificate and key for etcd.
  client-cert.pem: base64(ca-cert)
  client-key.pem: base64(ca-cert)
---
apiVersion: batch/v1
kind: Job
metadata:
  name: gardener-etcd-migrator
  namespace: garden
spec:
  backoffLimit: 0
  template:
    spec:
      containers:
      - name: registry-migrator
        image: eu.gcr.io/gardener-project/gardener/registry-migrator:v1.0.0
        command:
        - /bin/sh
        - -c
        - '
          /registry-migrator
            --endpoints $(ENDPOINTS)
            --ca /var/lib/etcd-migration/tls/ca/ca.pem
            --cert /var/lib/etcd-migration/tls/clientcert/client-cert.pem
            --key /var/lib/etcd-migration/tls/clientcert/client-key.pem
            --backup-file /var/lib/etcd-migration/backup/run1-etcd.backup
            --old-registry-prefix /registry/garden.sapcloud.io
            --new-registry-prefix /registry-gardener
            --force false
            --delete false
          &&
          /registry-migrator
            --endpoints $(ENDPOINTS)
            --ca /var/lib/etcd-migration/tls/ca/ca.pem
            --cert /var/lib/etcd-migration/tls/clientcert/client-cert.pem
            --key /var/lib/etcd-migration/tls/clientcert/client-key.pem
            --backup-file /var/lib/etcd-migration/backup/run2-etcd.backup
            --old-registry-prefix /registry-gardener/garden.sapcloud.io
            --new-registry-prefix /registry-gardener/core.gardener.cloud
            --force false
            --delete false
          '
        env:
        - name: ENDPOINTS
          # TODO: Change this value and enter your etcd endpoints
          value: http://docker.for.mac.localhost:32379
        volumeMounts:
        - name: ca
          mountPath: /var/lib/etcd-migration/tls/ca
        - name: clientcert
          mountPath: /var/lib/etcd-migration/tls/clientcert
        - name: backup
          mountPath: /var/lib/etcd-migration/backup
      restartPolicy: Never
      volumes:
      - name: ca
        secret:
          secretName: etcd-migration-ca
      - name: clientcert
        secret:
          secretName: etcd-migration-clientcert
      - name: backup
        hostPath:
          # TODO: Change this value and enter a path on the host where you want to store the etcd backups
          path: /some/path/where/you/want/to/store/the/etcd/backup