apiVersion: batch/v1
kind: CronJob
metadata:
  name: elasticsearch-log-retention
  namespace: elastic
  labels:
    app.kubernetes.io/name: elasticsearch-log-retention
    app.kubernetes.io/part-of: elastic-stack
spec:
  schedule: "0 13 * * *"
  timeZone: Europe/Vienna
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 3600
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 14400
      template:
        metadata:
          labels:
            app.kubernetes.io/name: elasticsearch-log-retention
            app.kubernetes.io/part-of: elastic-stack
        spec:
          automountServiceAccountToken: false
          restartPolicy: Never
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: prune-expired-logs
              image: docker.elastic.co/elasticsearch/elasticsearch-wolfi:9.5.5
              imagePullPolicy: IfNotPresent
              command:
                - /bin/sh
                - -ec
              args:
                - |
                  response=$(curl --silent --show-error --fail --max-time 14400 \
                    --cacert /tls/ca.crt \
                    --user "elastic:${ELASTIC_PASSWORD}" \
                    --header 'Content-Type: application/json' \
                    --data-binary '{"query":{"range":{"@timestamp":{"lt":"now-14d"}}}}' \
                    'https://elasticsearch-es-http.elastic.svc:9200/logs-traefik.access-default,logs-elastic_agent-default/_delete_by_query?conflicts=proceed&refresh=true&requests_per_second=5000')
                  printf '%s\n' "$response"
                  printf '%s' "$response" | grep -Eq '"failures"[[:space:]]*:[[:space:]]*\[\]' || {
                    echo "Elasticsearch reported delete-by-query failures" >&2
                    exit 1
                  }
              env:
                - name: ELASTIC_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: elasticsearch-es-elastic-user
                      key: elastic
              resources:
                requests:
                  cpu: 100m
                  memory: 128Mi
                limits:
                  cpu: 500m
                  memory: 512Mi
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              volumeMounts:
                - name: elasticsearch-http-ca
                  mountPath: /tls
                  readOnly: true
          volumes:
            - name: elasticsearch-http-ca
              secret:
                secretName: elasticsearch-es-http-certs-public
                items:
                  - key: ca.crt
                    path: ca.crt