{{- if .Values.upgradeCRDs }}
{{/* 'securityContext' got renamed to 'podSecurityContext', merge both dicts into one for backward compatibility */}}
{{- $podSecurityContext := merge (.Values.podSecurityContext | default dict) (.Values.securityContext | default dict) -}}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "velero.fullname" . }}-upgrade-crds
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
    "helm.sh/hook-weight": "5"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    app.kubernetes.io/name: {{ include "velero.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    helm.sh/chart: {{ include "velero.chart" . }}
  {{- with .Values.kubectl.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  backoffLimit: 3
  template:
    metadata:
      name: velero-upgrade-crds
      {{- with .Values.kubectl.labels }}
      labels:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.kubectl.annotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
    {{- if .Values.image.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.imagePullSecrets }}
        - name: {{ . }}
      {{- end }}
    {{- end }}
      serviceAccountName: {{ include "velero.serverServiceAccount" . }}-upgrade-crds
      automountServiceAccountToken: {{ .Values.upgradeCRDsJob.automountServiceAccountToken }}
      initContainers:
        - name: kubectl
          {{- if .Values.kubectl.image.digest }}
          image: "{{ .Values.kubectl.image.repository }}@{{ .Values.kubectl.image.digest }}"
          {{- else if .Values.kubectl.image.tag }}
          image: "{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
          {{- else }}
          image: "{{ .Values.kubectl.image.repository }}:{{ template "chart.KubernetesVersion" . }}"
          {{- end }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - /bin/sh
          args:
            - -c
            - cp `which sh` /tmp && cp `which kubectl` /tmp
          {{- with .Values.kubectl.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.kubectl.containerSecurityContext }}
          securityContext:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          volumeMounts:
            - mountPath: /tmp
              name: crds
      containers:
        - name: velero
          {{- if .Values.image.digest }}
          image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
          {{- else }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          {{- end }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - {{ .Values.upgradeCRDsJob.shellCmd | default "/tmp/sh" }}
          args:
            - -c
            - {{ .Values.upgradeCRDsJob.updateCmd | default "/velero install --crds-only --dry-run -o yaml | /tmp/kubectl apply -f -" }}
          {{- with .Values.upgradeJobResources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.containerSecurityContext }}
          securityContext:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          volumeMounts:
            - mountPath: /tmp
              name: crds
          {{- if (.Values.upgradeCRDsJob).extraVolumeMounts }}
          {{- toYaml .Values.upgradeCRDsJob.extraVolumeMounts | nindent 12 }}
          {{- end }}
          {{- if (.Values.upgradeCRDsJob).extraEnvVars }}
          env:
          {{- with .Values.upgradeCRDsJob.extraEnvVars }}
          {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- end }}
      volumes:
        - name: crds
          emptyDir: {}
        {{- if (.Values.upgradeCRDsJob).extraVolumes }}
        {{- toYaml .Values.upgradeCRDsJob.extraVolumes | nindent 8 }}
        {{- end }}
      restartPolicy: OnFailure
      {{- with $podSecurityContext }}
      securityContext:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{- end }}