apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app.kubernetes.io/name: dancefetcher
  name: dancefetcher
spec:
  schedule: '0 0 * * *'
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          imagePullSecrets:
            - name: oci-registry
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: dancefetcher
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
              image: ${IMAGE}
              imagePullPolicy: Always
              resources:
                limits:
                  memory: 200Mi
                requests:
                  cpu: 20m
                  memory: 30Mi
          restartPolicy: OnFailure