use kubernetes cron for nextcloud cronjob

kustomize/bases/nextcloud/kustomization.yaml

@@ -2,6 +2,7 @@ resources:
   - ../postgres
   - ../redis
   - nextcloud-deployment.yaml
+  - nextcloud-cronjob.yaml
   - nextcloud-ingress.yaml
 
 namePrefix: nextcloud-

kustomize/bases/nextcloud/nextcloud-cronjob.yaml

@@ -0,0 +1,65 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: server-cron
+  labels:
+    app.kubernetes.io/name: nextcloud
+    app.kubernetes.io/component: cron
+spec:
+  schedule: "*/5 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nextcloud
+        app.kubernetes.io/component: cron
+    spec:
+      backoffLimit: 0 # no retry
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: nextcloud
+            app.kubernetes.io/component: cron
+        spec:
+          restartPolicy: Never
+          serviceAccountName: server-cron
+          containers:
+          - name: kubectl
+            image: bitnami/kubectl
+            imagePullPolicy: IfNotPresent
+            command: ["/bin/bash"]
+            args:
+              - -xc
+              - kubectl exec "$(kubectl get pods -l 'app.kubernetes.io/component=server' -o name)" -- /bin/bash -c '( if ! which sudo &>/dev/null; then apt update && apt install sudo; fi ) && sudo -u www-data php -f /var/www/html/cron.php'
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: server-cron
+automountServiceAccountToken: true
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pod-list-exec
+rules:
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: server-cron
+subjects:
+- kind: ServiceAccount
+  name: server-cron
+roleRef:
+  kind: Role
+  name: pod-list-exec
+  apiGroup: rbac.authorization.k8s.io

kustomize/env/prod/kustomization.yaml

@@ -30,12 +30,13 @@ images:
   - name: drone/drone-runner-kube
     newTag: 1.0.0-rc.3
   - name: nextcloud
-    newName: badjware/nextcloud-tweak
     newTag: 25.0.3
   - name: postgres
     newTag: 9.6.23
   - name: redis
     newTag: 6.2.10
+  - name: bitnami/kubectl
+    newTag: "1.25"
 
 # configMapGenerator:
   # - name: ecommerce-exporter-config