# Bybit survivorship-free klines (perp+spot close) ingest -> TimescaleDB `bybit_features`, as a durable one-shot Job.
#
# FULLY-DECOUPLED BATCH (the warehouse-consolidation payoff): NO PVC, NO podAffinity — it fetches the Bybit
# public API (443) and writes TimescaleDB over the network (5432), so it schedules on ANY node with room.
# git-sync brings the new code (bybit-ingest-funding CLI). Idempotent (ON CONFLICT upsert) -> safe to re-run.
apiVersion: batch/v1
kind: Job
metadata:
  name: fxhnt-bybit-worst-basis
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-bybit-worst-basis, app.kubernetes.io/part-of: foxhunt }
spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 604800
  template:
    metadata:
      labels: { app.kubernetes.io/name: fxhnt-bybit-worst-basis, app.kubernetes.io/part-of: foxhunt }
    spec:
      restartPolicy: Never
      imagePullSecrets:
        - name: scw-registry
      initContainers:
        - name: git-sync
          image: alpine/git:latest
          command: [/bin/sh, -c]
          args:
            - |
              mkdir -p /root/.ssh && cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
              rm -rf /code/src
              git clone --depth 1 --branch master --filter=blob:none --sparse \
                "ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /tmp/repo
              cd /tmp/repo && git sparse-checkout set src && [ -d /tmp/repo/src ]
              cp -a /tmp/repo/src /code/src && echo "git-sync OK: $(git rev-parse --short HEAD)"
          resources: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
          volumeMounts:
            - { name: code, mountPath: /code }
            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
      containers:
        - name: ingest
          image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
          command: ["fxhnt", "bybit-ingest-worst-basis", "--symbols", "liquid", "--min-dollar-vol", "10000000", "--workers", "12"]
          env:
            - { name: PYTHONPATH, value: /code/src }
            - { name: FXHNT_OPERATIONAL_DSN, value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt" }
            - name: PGPASSWORD
              valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
            - { name: PYTHONUNBUFFERED, value: "1" }
          resources:
            requests: { memory: "1Gi", cpu: "500m" }
            limits: { memory: "4Gi", cpu: "2" }       # light (per-symbol funding); no PVC
          volumeMounts:
            - { name: code, mountPath: /code, readOnly: true }
      volumes:
        - { name: code, emptyDir: {} }
        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
---
# Egress: DNS + Postgres/Timescale (5432) + external 443 (api.bybit.com + public.bybit.com) + gitea-sshd (2222, git-sync).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-bybit-worst-basis
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector: { matchLabels: { app.kubernetes.io/name: fxhnt-bybit-worst-basis } }
  policyTypes: [Egress]
  egress:
    - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: postgres } } }]
      ports: [{ port: 5432, protocol: TCP }]
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]
      ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
    - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }]   # Bybit public API
      ports: [{ port: 443, protocol: TCP }]
