---
apiVersion: batch/v1
kind: Job
metadata:
  name: "unlock-${app}-${ts}"
  namespace: "${ns}"
spec:
  ttlSecondsAfterFinished: 3600
  template:
    spec:
      automountServiceAccountToken: false
      restartPolicy: OnFailure
      containers:
        - name: unlock-minio
          image: docker.io/restic/restic:0.18.0@sha256:4cf4a61ef9786f4de53e9de8c8f5c040f33830eb0a10bf3d614410ee2fcb6120
          args: ["unlock", "--remove-all"]
          envFrom:
            - secretRef:
                name: "${app}-volsync-secret"
        - name: unlock-r2
          image: docker.io/restic/restic:0.18.0@sha256:4cf4a61ef9786f4de53e9de8c8f5c040f33830eb0a10bf3d614410ee2fcb6120
          args: ["unlock", "--remove-all"]
          envFrom:
            - secretRef:
                name: "${app}-volsync-r2-secret"