# Excubitor weekly red team as a Kubernetes CronJob, for an agent that is only
# reachable inside your cluster. Same command and the same rules as
# github-action-excubitor-redteam.yml: point it at a STAGING agent, and the
# report goes to the console named by EXCUBITOR_CONSOLE_URL.
#
#   kubectl create secret generic excubitor-redteam \
#     --from-literal=EXCUBITOR_CONSOLE_URL=https://... \
#     --from-literal=EXCUBITOR_TOKEN=... \
#     --from-literal=STAGING_AGENT_TOKEN=...
#   kubectl create configmap excubitor-probe-packs --from-file=shield-findings.json
apiVersion: batch/v1
kind: CronJob
metadata:
  name: excubitor-redteam
spec:
  schedule: "0 4 * * 0"          # Sundays 04:00 UTC
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      backoffLimit: 0            # a failed run is reported, not retried into the week
      activeDeadlineSeconds: 1800
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: redteam
              image: python:3.12-slim
              command: ["sh", "-c"]
              args:
                - >-
                  pip install --quiet excubitor-sdk &&
                  excubitor-redteam --agent invoice-copilot --schedule weekly
                  --url http://invoice-copilot.staging.svc.cluster.local/ask
                  --field message --answer answer
                  --header 'Authorization: Bearer ${STAGING_AGENT_TOKEN}'
                  $( [ -f /packs/shield-findings.json ] && echo --pack /packs/shield-findings.json )
              envFrom:
                - secretRef:
                    name: excubitor-redteam
              volumeMounts:
                - name: packs
                  mountPath: /packs
          volumes:
            - name: packs
              configMap:
                name: excubitor-probe-packs
                optional: true