# One-shot E2E smoke — run as a deploy verification gate.
# Wire as an ArgoCD PostSync hook (annotation below) OR call from an Argo Rollouts
# AnalysisTemplate. Job success == the app is actually viewable in Safari's engine;
# failure fails the sync/rollout.
#
# NOTE: not yet added to any kustomization / app-of-apps. Wiring = migration phase 7.
apiVersion: batch/v1
kind: Job
metadata:
  name: e2e-smoke
  namespace: platform
  annotations:
    # Uncomment to make this a deploy gate on the owning Application:
    # argocd.argoproj.io/hook: PostSync
    # argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-options: Prune=false
spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 86400
  template:
    spec:
      restartPolicy: Never
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: e2e
          # Built + pushed by CI from tests/e2e/Dockerfile. Pin a digest in prod.
          image: forgejo-gitea-http.cicd.svc.cluster.local:3000/riotpiao.com/homelab-e2e:latest
          imagePullPolicy: Always
          env:
            - name: BASE_DOMAIN
              value: riotpiao.com
            # strict TLS by default; set "1" only during staging-cert bootstrap
            - name: E2E_IGNORE_TLS
              value: "0"
            - name: CI
              value: "1"
            - name: AK_ADMIN_USER
              value: akadmin
            - name: AK_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: e2e-credentials
                  key: authentik-admin-password
            - name: MINIO_ENDPOINT
              value: http://minio.storage.svc.cluster.local:9000
            - name: MINIO_BUCKET
              value: e2e-artifacts
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef: { name: e2e-credentials, key: minio-access-key }
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef: { name: e2e-credentials, key: minio-secret-key }
          resources:
            requests: { cpu: 200m, memory: 512Mi }
            limits: { cpu: "1", memory: 2Gi }