kubernetes-cronjob.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: velero-watchdog
  namespace: velero
  labels:
    app: velero
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: velero-watchdog-role
  namespace: velero
  labels:
    app: velero
rules:
  - apiGroups:
      - velero.io
    resources:
      - "*"
    verbs:
      - "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: velero-watchdog-clusterrole
rules:
  - apiGroups:
      - "velero.io"
    resources:
      - "*"
    verbs:
      - "get"
      - "list"
      - "create"
      - "patch"
      - "update"
      - "watch"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: velero-watchdog-rolebinding
  namespace: velero
  labels:
    app: velero
subjects:
  - kind: ServiceAccount
    namespace: velero
    name: velero-watchdog
roleRef:
  kind: Role
  name: velero-watchdog
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: velero-watchdog-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: velero-watchdog
    namespace: velero
roleRef:
  kind: ClusterRole
  name: velero-watchdog-clusterrole
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: velero-watchdog
  namespace: velero
  labels:
    app: velero
spec:
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  schedule: "*/30 * * * *"
  jobTemplate:
    spec:
      backoffLimit: 0
      template:
        metadata:
          labels:
            app: velero
        spec:
          serviceAccountName: velero-watchdog
          containers:
            - name: velero-watchdog
              image: veerendra2/velero-watchdog:0.1.3
              imagePullPolicy: IfNotPresent
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop: [ALL]
                privileged: false
                readOnlyRootFilesystem: true
                runAsNonRoot: true
                seccompProfile:
                  type: RuntimeDefault
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
              resources:
                requests:
                  memory: "300Mi"
                  cpu: "200m"
                limits:
                  memory: "300Mi"
          dnsPolicy: ClusterFirst
          restartPolicy: Never
          schedulerName: default-scheduler
          terminationGracePeriodSeconds: 30
          securityContext:
            runAsUser: 1001
            runAsGroup: 1001
            fsGroup: 1001