# helm_charts_migrations-pre-upgrade.yaml
{{- if (and (.Values.runMigrations) (not (eq .Values.env.database "off"))) }}
# Why is this Job duplicated and not using only helm hooks?
# See: https://github.com/helm/charts/pull/7362
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kong.fullname" . }}-pre-upgrade-migrations
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
    app.kubernetes.io/component: pre-upgrade-migrations
  annotations:
    helm.sh/hook: "pre-upgrade"
    helm.sh/hook-delete-policy: "before-hook-creation"
spec:
  template:
    metadata:
      name: {{ template "kong.name" . }}-pre-upgrade-migrations
      labels:
        {{- include "kong.metaLabels" . | nindent 8 }}
        app.kubernetes.io/component: pre-upgrade-migrations
    spec:
      {{- if .Values.podSecurityPolicy.enabled }}
      serviceAccountName: {{ template "kong.serviceAccountName" . }}
      {{- end }}
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      initContainers:
      {{- if (eq .Values.env.database "postgres") }}
      {{- include "kong.wait-for-postgres" . | nindent 6 }}
      {{- end }}
      containers:
      - name: {{ template "kong.name" . }}-upgrade-migrations
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        {{- include "kong.final_env" . | nindent 8 }}
        command: [ "/bin/sh", "-c", "kong migrations up" ]
        volumeMounts:
        {{- include "kong.volumeMounts" . | nindent 8 }}
      securityContext:
      {{- include "kong.podsecuritycontext" . | nindent 8 }}
      restartPolicy: OnFailure
      volumes:
      {{- include "kong.volumes" . | nindent 6 -}}
{{- end }}

{{ if or .Values.podSecurityPolicy.enabled (and .Values.ingressController.enabled .Values.ingressController.serviceAccount.create) -}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "kong.serviceAccountName" . }}
  namespace: {{ .Release.namespace }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    {{- include "kong.metaLabels" . | nindent 4 }}
{{- end -}}