k8s: add weekly refresh cronjob for cacao-demo and ca-wolves

Recreates both deployments every Sunday at 03:00 UTC to pull
fresh app code from the source repos (deployments use git-clone
init containers, so a restart picks up upstream changes).

Resource requests=limits to satisfy the schmidtdse namespace's
gatekeeper ratio policy. Uses alpine/k8s image since
bitnami/kubectl was deprecated and rancher/kubectl is FROM scratch
(no shell).

Author: cboettig

k8s/refresh-cronjob.yaml

@@ -0,0 +1,107 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: schmidtdse-refresh
+  namespace: schmidtdse
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: schmidtdse-refresh
+  namespace: schmidtdse
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: schmidtdse-refresh
+  namespace: schmidtdse
+subjects:
+- kind: ServiceAccount
+  name: schmidtdse-refresh
+  namespace: schmidtdse
+roleRef:
+  kind: Role
+  name: schmidtdse-refresh
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: schmidtdse-refresh
+  namespace: schmidtdse
+spec:
+  # Weekly, Sundays at 03:00 UTC
+  schedule: "0 3 * * 0"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          serviceAccountName: schmidtdse-refresh
+          restartPolicy: OnFailure
+          initContainers:
+          - name: git-clone-cacao-demo
+            image: alpine/git:2.52.0
+            command:
+            - sh
+            - -c
+            - git clone --depth 1 https://github.com/SchmidtDSE/cacao-demo.git /workspace/cacao-demo
+            resources:
+              requests:
+                cpu: "100m"
+                memory: "128Mi"
+              limits:
+                cpu: "100m"
+                memory: "128Mi"
+            volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+          - name: git-clone-ca-wolves
+            image: alpine/git:2.52.0
+            command:
+            - sh
+            - -c
+            - git clone --depth 1 https://github.com/SchmidtDSE/ca-wolves.git /workspace/ca-wolves
+            resources:
+              requests:
+                cpu: "100m"
+                memory: "128Mi"
+              limits:
+                cpu: "100m"
+                memory: "128Mi"
+            volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+          containers:
+          - name: kubectl
+            image: alpine/k8s:1.30.14
+            workingDir: /workspace
+            command:
+            - sh
+            - -c
+            - |
+              set -e
+              for repo in cacao-demo ca-wolves; do
+                kubectl delete -f "${repo}/k8s/deployment.yaml" --ignore-not-found
+                kubectl apply  -f "${repo}/k8s/deployment.yaml"
+              done
+            resources:
+              requests:
+                cpu: "200m"
+                memory: "256Mi"
+              limits:
+                cpu: "200m"
+                memory: "256Mi"
+            volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+          volumes:
+          - name: workspace
+            emptyDir: {}