---
# Kasm DB Restore Job
#
# Use this to restore a Kasm database backup into a running Kasm deployment.
# Typical use cases:
#   - Migrating from a VM-based Kasm deployment to Kubernetes
#
# Prerequisites:
#   - This job must be deployed in the same namespace as your Kasm Helm release.
#   - The database and user are created automatically when the Helm chart is installed.
#     Do NOT set dbManagement.initialize=true — doing so will pre-populate the schema
#     and conflict with the restore.
#   - The PVC must already exist and contain your backup file before applying this job.
#
# Field reference:
#   POSTGRES_HOST       — DB service name. Retrieve with: kubectl -n {NAMESPACE} get service
#   POSTGRES_DB         — Defaults to kasm. Only change if you overrode database.kasmDbName in my-values.yaml.
#   POSTGRES_USER       — Defaults to kasmapp. Only change if you overrode database.kasmDbUser in my-values.yaml.
#   secretKeyRef.name   — Must be {RELEASE_NAME}-secrets, where {RELEASE_NAME} is your Helm release name.
#   secretKeyRef.key    — The key storing the DB password. Auto-generated by the Helm chart; defaults to db-password.
#   claimName           — PVC containing the backup file. Keep default (kasm-db-dump-pvc) unless you
#                         changed claimName in db-upload.yaml.
#
# Before applying:
#   1. Replace all values marked with # <-- REPLACE
#   2. Apply with:  kubectl apply -n {NAMESPACE} -f examples/db-restore.yaml
#   3. Monitor with: kubectl logs -f job/kasm-db-restore -n {NAMESPACE}
#
apiVersion: batch/v1
kind: Job
metadata:
  name: kasm-db-restore
spec:
  ttlSecondsAfterFinished: 300
  template:
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      restartPolicy: OnFailure
      containers:
        - name: kasm-db-restore
          image: kasmweb/api:1.19.0  # <-- REPLACE with your Kasm version
          imagePullPolicy: IfNotPresent
          env:
            - name: POSTGRES_HOST
              value: "POSTGRES_HOST"   # <-- REPLACE with your DB service name
            - name: POSTGRES_PORT
              value: "5432"
            - name: POSTGRES_DB
              value: kasm  # <-- REPLACE with your Kasm database name
            - name: POSTGRES_USER
              value: kasmapp  # <-- REPLACE with your Kasm database user
            - name: BACKUP_FILENAME
              value: kasm_dump.tar
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: "{RELEASE_NAME}-secrets"  # <-- REPLACE {RELEASE_NAME} with your Helm release name
                  key: db-password  # <-- REPLACE with the key name storing the DB password in your secret
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          command:
            - "/bin/bash"
            - "-c"
          args:
            - |
              set -e
              while ! pg_isready -h ${POSTGRES_HOST} -p ${POSTGRES_PORT} -t 10; do echo "Waiting for DB..."; sleep 5; done
              export PGPASSWORD=$POSTGRES_PASSWORD
              BACKUP_FILE="/data/kasm-db-dump/$BACKUP_FILENAME"
              echo "Restoring database from $BACKUP_FILE"
              pg_restore -h "${POSTGRES_HOST}" -p "${POSTGRES_PORT}" -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" "${BACKUP_FILE}"
              echo "Restore complete"
          volumeMounts:
            - name: kasm-db-dump
              mountPath: /data/kasm-db-dump
              readOnly: true
      volumes:
        - name: kasm-db-dump
          persistentVolumeClaim:
            claimName: kasm-db-dump-pvc  # <-- REPLACE with your backup PVC name (must match claimName in db-upload.yaml)