# One-shot DuckDB -> TimescaleDB warehouse migration, as a durable Job.
#
# WHY A JOB (not `kubectl exec`/nohup): exec-spawned processes are reaped when the streaming connection drops
# (it killed the migration at 47%). A Job is a first-class workload the kubelet runs to completion independent
# of any client. This is the REUSABLE batch-job pattern (git-sync new code + own memory + RWO-PVC affinity)
# that future batch (Bybit ingest, paper-backfill) should follow instead of running inside the 2Gi daemon.
#
# WHY git-sync init: the baked cockpit image lacks the new `warehouse-migrate-pg` CLI; the init clones master
# src/ to /code so `fxhnt` runs it via PYTHONPATH=/code/src (same pattern as the dagster/dashboard pods).
#
# WHY podAffinity to dagster: the source DuckDB lives on the RWO `fxhnt-surfer-data` PVC (single-node attach),
# mounted by dagster. The Job MUST co-locate on that node to read it. (The DESTINATION TimescaleDB is networked
# Postgres — once this migration + cutover land, batch no longer needs the RWO PVC and can run anywhere.)
#
# Idempotent (ON CONFLICT upsert) -> safe to re-run (delete + re-apply). Memory-bounded (chunked stream).
apiVersion: batch/v1
kind: Job
metadata:
  name: fxhnt-warehouse-migrate
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-warehouse-migrate, app.kubernetes.io/part-of: foxhunt }
spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 604800   # 7d — keep for log inspection
  template:
    metadata:
      labels: { app.kubernetes.io/name: fxhnt-warehouse-migrate, app.kubernetes.io/part-of: foxhunt }
    spec:
      restartPolicy: Never
      imagePullSecrets:
        - name: scw-registry
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector: { matchLabels: { app.kubernetes.io/name: dagster } }
              topologyKey: kubernetes.io/hostname   # co-locate with dagster for the RWO warehouse PVC
      initContainers:
        - name: git-sync                            # clone master src -> /code so `fxhnt` runs the new code (PYTHONPATH=/code/src)
          image: alpine/git:latest
          command: [/bin/sh, -c]
          args:
            - |
              mkdir -p /root/.ssh && cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
              rm -rf /code/src
              git clone --depth 1 --branch master --filter=blob:none --sparse \
                "ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /tmp/repo
              cd /tmp/repo && git sparse-checkout set src && [ -d /tmp/repo/src ]
              cp -a /tmp/repo/src /code/src && echo "git-sync OK: $(git rev-parse --short HEAD)"
          resources: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
          volumeMounts:
            - { name: code, mountPath: /code }
            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
      containers:
        - name: migrate
          image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
          command: ["fxhnt", "warehouse-migrate-pg", "--chunk-rows", "100000"]
          env:
            - { name: PYTHONPATH, value: /code/src }   # git-sync'd new code wins over the baked image
            - { name: FXHNT_WAREHOUSE_PATH, value: /data/surfer/warehouse.duckdb }
            - { name: FXHNT_SURFER_DATA_DIR, value: /data/surfer }
            - { name: FXHNT_OPERATIONAL_DSN, value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt" }
            - name: PGPASSWORD
              valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
            - { name: PYTHONUNBUFFERED, value: "1" }   # stream progress live
          resources:
            requests: { memory: "512Mi", cpu: "500m" }
            limits: { memory: "3Gi", cpu: "2" }        # own budget (chunked stream needs ~100MB; headroom plenty)
          volumeMounts:
            - { name: surfer-data, mountPath: /data, readOnly: true }   # source DuckDB (read-only)
            - { name: code, mountPath: /code, readOnly: true }
      volumes:
        - { name: surfer-data, persistentVolumeClaim: { claimName: fxhnt-surfer-data } }
        - { name: code, emptyDir: {} }
        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
---
# Egress: default-deny-all -> this Job needs DNS + Postgres (5432, the destination) + gitea-sshd (2222, git-sync).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-warehouse-migrate
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector: { matchLabels: { app.kubernetes.io/name: fxhnt-warehouse-migrate } }
  policyTypes: [Egress]
  egress:
    - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: postgres } } }]
      ports: [{ port: 5432, protocol: TCP }]
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]
      ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
