{{- if .Values.alembic.enabled }}
# Job pre-upgrade que corre Alembic antes de rolar el Deployment.
# - backoffLimit: 0  → si falla, NO reintenta; Helm aborta el upgrade.
# - hook-delete-policy hook-succeeded → solo se borra al éxito; en fallo queda
#   visible para `kubectl logs job/...` y diagnóstico.
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-alembic-{{ .Release.Revision }}
  labels:
    {{- include "app.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-upgrade,pre-install
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 600
  template:
    metadata:
      labels:
        {{- include "app.labels" . | nindent 8 }}
    spec:
      restartPolicy: Never
      serviceAccountName: {{ .Release.Name }}
      imagePullSecrets:
        - name: {{ .Values.image.pullSecret }}
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
      containers:
        - name: alembic
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          command: {{ .Values.alembic.command | toJson }}
          envFrom:
            - secretRef:
                name: {{ .Values.database.secretName }}
          env:
            # Si el Secret expone MIGRATION_DATABASE_URL, lo usa; si no, env.py
            # cae a DATABASE_URL automáticamente (ver settings.migration_url).
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.database.secretName }}
                  key: DATABASE_URL
            - name: MIGRATION_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.database.secretName }}
                  key: MIGRATION_DATABASE_URL
                  optional: true
          resources:
            {{- toYaml .Values.alembic.resources | nindent 12 }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
{{- end }}