--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/roles.yaml	Thu Mar 16 18:11:02 2023 -0700
@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: photoprism
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  # for the exec in the cronjob
+  - pods/exec
+  verbs: ["*"]
+- nonResourceURLs: ["/metrics"]
+  verbs: ["get"]
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: photoprism
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: photoprism
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: photoprism
+subjects:
+- kind: ServiceAccount
+  name: photoprism
+  namespace: default
+- kind: ServiceAccount
+  name: default
+  namespace: default
\ No newline at end of file

--- a/skaffold.yaml	Thu Mar 16 18:09:55 2023 -0700
+++ b/skaffold.yaml	Thu Mar 16 18:11:02 2023 -0700
@@ -4,6 +4,7 @@
   name: photoprism
 manifests:
   rawYaml:
+  - roles.yaml
   - deploy.yaml
   - ingress.yaml
   - update_job.yaml

--- a/update/Dockerfile	Thu Mar 16 18:09:55 2023 -0700
+++ b/update/Dockerfile	Thu Mar 16 18:11:02 2023 -0700
@@ -1,5 +1,12 @@
 FROM bang5:5000/base_basic
 WORKDIR /opt
+RUN apt install -y python3-atomicwrites
+
+
+# from /my/proj/infra/kube.py
+RUN curl -L -o ./kubectl https://github.com/rancher/k3s/releases/download/v1.24.3+k3s1/k3s
+RUN chmod +x kubectl
+
 COPY update.sh ./
 
 CMD ["./update.sh"]
\ No newline at end of file

--- a/update/update.sh	Thu Mar 16 18:09:55 2023 -0700
+++ b/update/update.sh	Thu Mar 16 18:11:02 2023 -0700
@@ -1,12 +1,14 @@
 #!/bin/zsh
 
 date
-/my/pda/note10/copy_photos > /tmp/photo_touched_dirs
-
+useradd -MN -u 501 drewp
+grep drewp /etc/passwd
+runuser -u drewp -- /my/pda/note10/copy_photos > /tmp/photo_touched_dirs
+wc /tmp/photo_touched_dirs
 date
 
 for x (`cat /tmp/photo_touched_dirs`) {
-  kubectl exec -it deploy/photoprism -c photoprism -- photoprism index $x
+  ./kubectl exec deploy/photoprism -c photoprism -- photoprism index $x
 }
 
 touch /my/pda/note10/photos_updated

--- a/update_job.yaml	Thu Mar 16 18:09:55 2023 -0700
+++ b/update_job.yaml	Thu Mar 16 18:11:02 2023 -0700
@@ -3,19 +3,32 @@
 metadata:
   name: photoprism-update
 spec:
+  # run one now with this:
+  #   k delete job/updatetest ; k create job --from=cronjob/photoprism-update updatetest
   schedule: "20 3 * * *"
   concurrencyPolicy: Replace
   jobTemplate:
     spec:
       template:
         spec:
+          serviceAccountName: photoprism
           volumes:
             - { name: my, persistentVolumeClaim: { claimName: my } }
           containers:
           - name: update
             image: bang5:5000/photoprism_update
             volumeMounts:
-              - { name: my, mountPath: /my/pic, subPath: pic }
-              - { name: my, mountPath: /my/pda/note10, subPath: pda/note10 }
+              #- { name: my, mountPath: /my/pic, subPath: pic }
+              #- { name: my, mountPath: /my/pda/note10, subPath: pda/note10 }
+              - { name: my, mountPath: /my }
+              
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: "kubernetes.io/hostname"
+                        operator: In
+                        values: ["ditto"]  # anything with nfs, but bang is fastest right now  
           restartPolicy: Never
       backoffLimit: 1