# DEPRECATED (2026-08-14): the initial production schema is executed manually
# from database/migrations/*.sql plus application-role grants. This Job is not
# part of the first-deployment path; keep the manifest only as an optional
# automation reference.
apiVersion: batch/v1
kind: Job
metadata:
  name: zhinian-db-migrate
  namespace: zhinian
spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        app.kubernetes.io/name: zhinian
        app.kubernetes.io/component: database-migration
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: migrate
          image: REGISTRY/PROJECT/zhinian-aigc:REPLACE_TAG
          imagePullPolicy: IfNotPresent
          command: ["node", "scripts/migrate-postgres.mjs"]
          env:
            - name: NODE_ENV
              value: production
            - name: ZHINIAN_DATA_BACKEND
              value: postgres
            # Must match the username in zhinian-web-db/DATABASE_URL.
            - name: DATABASE_APP_ROLE
              value: REPLACE_WITH_RDS_APP_ROLE
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: zhinian-migration-db
                  key: DATABASE_URL
            - name: DATABASE_SSL_MODE
              value: verify-full
            - name: DATABASE_CA_CERT_PATH
              value: /etc/zhinian/rds/ca.pem
            - name: DATABASE_CONNECTION_TIMEOUT_MS
              value: "5000"
            - name: DATABASE_STATEMENT_TIMEOUT_MS
              value: "60000"
          volumeMounts:
            - name: rds-ca
              mountPath: /etc/zhinian/rds
              readOnly: true
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: rds-ca
          secret:
            secretName: zhinian-rds-ca