# In-cluster platform build (Kaniko → Harbor abrban/). Apply via scripts/trigger-platform-build.sh
# Base images pulled via Harbor proxy-cache — no separate mirror job.
apiVersion: batch/v1
kind: Job
metadata:
  name: build-platform-images
  namespace: cloudhost-builds
spec:
  ttlSecondsAfterFinished: 3600
  backoffLimit: 1
  template:
    spec:
      restartPolicy: Never
      imagePullSecrets:
        - name: registry-pull-secret
      initContainers:
        - name: git-clone
          image: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
          env:
            - name: GIT_REPO
              value: http://gitea-http.gitea.svc.cluster.local:3000/abrban/cloud-host.git
            - name: GIT_REF
              value: main
          command:
            - sh
            - -ec
            - |
              git clone --depth=1 --branch "${GIT_REF}" "${GIT_REPO}" /workspace
          volumeMounts:
            - name: workspace
              mountPath: /workspace
      containers:
        - name: kaniko
          image: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
          env:
            - name: IMAGE_TAG
              value: bootstrap
          command:
            - sh
            - -ec
            - |
              set -eux
              REG="harbor-core.cloudhost.svc.cluster.local/abrban"
              unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy || true
              export NO_PROXY="harbor-core.cloudhost.svc.cluster.local,harbor-registry.cloudhost.svc.cluster.local,registry.abrban.com,10.43.0.0/16,.svc,.cluster.local"
              export no_proxy="$NO_PROXY"
              /kaniko/executor \
                --dockerfile=/workspace/backend/Dockerfile \
                --context=dir:///workspace/backend \
                --destination="${REG}/cloudhost-backend:${IMAGE_TAG}" \
                --insecure --skip-tls-verify
              /kaniko/executor \
                --dockerfile=/workspace/frontend/Dockerfile \
                --context=dir:///workspace/frontend \
                --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com \
                --destination="${REG}/cloudhost-frontend:${IMAGE_TAG}" \
                --insecure --skip-tls-verify
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: docker-config
              mountPath: /kaniko/.docker
      volumes:
        - name: workspace
          emptyDir: {}
        - name: docker-config
          secret:
            secretName: kaniko-harbor-auth
            items:
              - key: .dockerconfigjson
                path: config.json