From c682154d3c1e37aa46d72686588ccae6c5aa2d80 Mon Sep 17 00:00:00 2001
From: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Wed, 8 Dec 2021 09:45:00 +0100
Subject: [PATCH] fix(fireflyiii) correct cronjob (#1487)

* fix(fireflyiii) correct cronjob

* add security policy to cronjob

* move cronjob to v1
---
 .../stable/fireflyiii/templates/_cronjob.tpl  | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/charts/stable/fireflyiii/templates/_cronjob.tpl b/charts/stable/fireflyiii/templates/_cronjob.tpl
index e32ee9bb70c..600f0a49e17 100644
--- a/charts/stable/fireflyiii/templates/_cronjob.tpl
+++ b/charts/stable/fireflyiii/templates/_cronjob.tpl
@@ -3,7 +3,7 @@
 {{- $jobName := include "common.names.fullname" . }}
 
 ---
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: {{ printf "%s-cronjob" $jobName }}
@@ -24,14 +24,30 @@ spec:
       template:
         metadata:
         spec:
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
           restartPolicy: Never
           containers:
             - name: {{ .Chart.Name }}
+              securityContext:
+                privileged: false
+                readOnlyRootFilesystem: true
+                allowPrivilegeEscalation: false
+                runAsNonRoot: true
+                capabilities:
+                  drop:
+                    - ALL
+              env:
+                - name: STATIC_CRON_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: fireflyiii-secrets
+                      key: STATIC_CRON_TOKEN
               image: "{{ .Values.alpineImage.repository }}:{{ .Values.alpineImage.tag }}"
-              imagePullPolicy: {{ default .Values.image.pullPolicy }}
               args:
               - curl
-              - "http://{{ $jobName }}.ix-{{ .Release.Name }}.svc.cluster.local:{{ .Values.service.main.ports.main.port }}/api/v1/cron/{{ .Values.env.STATIC_CRON_TOKEN }}"
+              - "http://{{ $jobName }}.ix-{{ .Release.Name }}.svc.cluster.local:{{ .Values.service.main.ports.main.port }}/api/v1/cron/$STATIC_CRON_TOKEN"
               resources:
 {{ toYaml .Values.resources | indent 16 }}