{{- if .Values.cronjobs.enabled }}
{{- range $jobKey, $jobConfig := .Values.cronjobs.jobs }}
{{- if $jobConfig.enabled }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: {{ include "sim.fullname" $ }}-{{ $jobConfig.name }}
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "sim.labels" $ | nindent 4 }}
    app.kubernetes.io/component: cronjob-{{ $jobConfig.name }}
spec:
  schedule: {{ $jobConfig.schedule | quote }}
  concurrencyPolicy: {{ $jobConfig.concurrencyPolicy | default "Forbid" }}
  successfulJobsHistoryLimit: {{ $jobConfig.successfulJobsHistoryLimit | default 3 }}
  failedJobsHistoryLimit: {{ $jobConfig.failedJobsHistoryLimit | default 1 }}
  {{- with $.Values.cronjobs.startingDeadlineSeconds }}
  startingDeadlineSeconds: {{ . }}
  {{- end }}
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: {{ $.Values.cronjobs.ttlSecondsAfterFinished | default 600 }}
      {{- with $.Values.cronjobs.activeDeadlineSeconds }}
      activeDeadlineSeconds: {{ . }}
      {{- end }}
      template:
        metadata:
          labels:
            {{- include "sim.selectorLabels" $ | nindent 12 }}
            app.kubernetes.io/component: cronjob-{{ $jobConfig.name }}
            # Stable group label so NetworkPolicy can allow all cron pods → app
            # without enumerating each job's component value.
            simstudio.ai/component-group: cronjob
        spec:
          serviceAccountName: {{ include "sim.serviceAccountName" $ }}
          automountServiceAccountToken: false
          restartPolicy: {{ $.Values.cronjobs.restartPolicy | default "OnFailure" }}
          {{- include "sim.podSecurityContext" $.Values.cronjobs | nindent 10 }}
          containers:
          - name: {{ $jobConfig.name }}
            image: {{ include "sim.image" (dict "imageRoot" $.Values.cronjobs.image "global" $.Values.global "chartAppVersion" $.Chart.AppVersion) }}
            imagePullPolicy: {{ $.Values.cronjobs.image.pullPolicy }}
            {{- include "sim.containerSecurityContext" $.Values.cronjobs | nindent 12 }}
            env:
            - name: CRON_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ include "sim.appSecretName" $ }}
                  key: CRON_SECRET
            command:
            - /bin/sh
            - -c
            args:
            - |
              echo "Starting cron job: {{ $jobConfig.name }}"
              echo "Making HTTP request to {{ $jobConfig.path }}"
              
              # Determine the service URL (use internal service regardless of ingress)
              SERVICE_URL="http://{{ include "sim.fullname" $ }}-app:{{ $.Values.app.service.port }}"
              
              # Make the HTTP request with timeout and retry logic
              for i in $(seq 1 3); do
                echo "Attempt $i/3"
                if curl -f -s -S --max-time 60 --retry 2 --retry-delay 5 \
                  -H "Content-Type: application/json" \
                  -H "User-Agent: Kubernetes-CronJob/{{ $jobConfig.name }}" \
                  -H "Authorization: Bearer ${CRON_SECRET}" \
                  "$SERVICE_URL{{ $jobConfig.path }}"; then
                  echo "Success: HTTP request completed"
                  exit 0
                fi
                echo "Attempt $i failed, retrying..."
                sleep 10
              done
              echo "Error: All attempts failed"
              exit 1
            resources:
              {{- toYaml $.Values.cronjobs.resources | nindent 14 }}
          {{- with $.Values.global.imagePullSecrets }}
          imagePullSecrets:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $.Values.app.nodeSelector }}
          nodeSelector:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $.Values.affinity }}
          affinity:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with $.Values.tolerations }}
          tolerations:
            {{- toYaml . | nindent 12 }}
          {{- end }}
{{- end }}
{{- end }}
{{- end }}