---
# Dispatcher CronJob — runs every 2 minutes, claims unclaimed tasks from Vikunja
# and spawns agent Jobs for each
apiVersion: batch/v1
kind: CronJob
metadata:
  name: dispatcher
  namespace: autojanet
  labels:
    autojanet/role: dispatcher
spec:
  schedule: "*/2 * * * *"
  concurrencyPolicy: Forbid       # never run two dispatchers simultaneously
  successfulJobsHistoryLimit: 5
  failedJobsHistoryLimit: 5
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 600
      template:
        metadata:
          labels:
            autojanet/role: dispatcher
        spec:
          serviceAccountName: dispatcher
          restartPolicy: Never
          containers:
            - name: dispatcher
              image: registry.ctz.fyi/library/autojanet-dispatcher:latest
              imagePullPolicy: Always
              env:
                - name: OPENBAO_ADDR
                  value: "http://openbao.openbao.svc.cluster.local:8200"
                - name: OPENBAO_ROLE_ID
                  valueFrom:
                    secretKeyRef:
                      name: dispatcher-approle
                      key: role_id
                - name: OPENBAO_SECRET_ID
                  valueFrom:
                    secretKeyRef:
                      name: dispatcher-approle
                      key: secret_id
                - name: VIKUNJA_BASE_URL
                  value: "http://vikunja.vikunja.svc.cluster.local:3456"
                - name: K8S_NAMESPACE
                  value: "autojanet"
                - name: AGENT_IMAGE
                  value: "registry.ctz.fyi/library/autojanet-agent:latest"
                - name: MAX_JOBS_PER_ROLE
                  value: "2"
                - name: MAX_JOBS_TOTAL
                  value: "10"
              resources:
                requests:
                  cpu: "100m"
                  memory: "128Mi"
                limits:
                  cpu: "500m"
                  memory: "256Mi"
              securityContext:
                allowPrivilegeEscalation: false
                runAsNonRoot: true
                runAsUser: 1000
                readOnlyRootFilesystem: true
                capabilities:
                  drop: ["ALL"]