apiVersion: batch/v1
kind: Job
metadata: {name: orders-migrate-REPLACE_CHANGE_ID, namespace: orders}
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 600
  ttlSecondsAfterFinished: 86400
  template:
    metadata: {labels: {app.kubernetes.io/part-of: orders}}
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext: {runAsNonRoot: true, runAsUser: 10001, fsGroup: 10001, seccompProfile: {type: RuntimeDefault}}
      containers:
        - name: migrate
          image: REPLACE_APPROVED_IMAGE_AT_DIGEST
          command: [python, migrate.py]
          envFrom: [{secretRef: {name: orders-migration}}]
          resources:
            requests: {cpu: 250m, memory: 256Mi}
            limits: {cpu: '1', memory: 512Mi}
          securityContext: {allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}}
          volumeMounts: [{name: db-ca, mountPath: /run/dbca, readOnly: true}]
      volumes: [{name: db-ca, configMap: {name: orders-db-ca}}]