apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: aqua-agent
  name: aqua-agent
  namespace: aqua
spec:
  selector:
    matchLabels:
      app: aqua-agent
  template:
    metadata:
      labels:
        app: aqua-agent
      name: aqua-agent
      namespace: aqua
      annotations:
        container.apparmor.security.beta.kubernetes.io/aqua-agent: unconfined
    spec:
      containers:
      - env:
        - name: AQUA_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: AQUA_TOKEN
          valueFrom:
            secretKeyRef:
              key: token
              name: enforcer-token
              optional: true
        envFrom:
        - configMapRef:
            name: aqua-csp-enforcer
        image: registry.aquasec.com/enforcer:master
        imagePullPolicy: Always
#        resources:
#          limits:
#            cpu: 1000m
#            memory: 1.5Gi
#          requests:
#            cpu: 350m
#            memory: 512Mi
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8096
          initialDelaySeconds: 60
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /readinessz
            port: 8096
          initialDelaySeconds: 60
          periodSeconds: 30
        ports:
        - containerPort: 8096
          protocol: TCP
        name: aqua-agent
        resources: {}
        securityContext:
          privileged: false
          capabilities:
              add:
                - SYS_ADMIN
                - NET_ADMIN
                - NET_RAW
                - SYS_PTRACE
                - KILL
                - MKNOD
                - SETGID
                - SETUID
                - SYS_MODULE
                - AUDIT_CONTROL
                - SYSLOG
                - SYS_CHROOT
                - SYS_RESOURCE
                - IPC_LOCK
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/run
          name: var-run
        - mountPath: /dev
          name: dev
        - mountPath: /host/sys
          name: sys
          readOnly: true
        - mountPath: /host/proc
          name: proc
          readOnly: true
        - mountPath: /host/etc
          name: etc
          readOnly: true
        - mountPath: /host/opt/aquasec
          name: aquasec
          readOnly: true
        - mountPath: /opt/aquasec/tmp
          name: aquasec-tmp
        - mountPath: /opt/aquasec/audit
          name: aquasec-audit
        - mountPath: /data
          name: aquasec-data
        # - mountPath: /opt/aquasec/ssl
        #   name: aqua-grpc-enforcer
      dnsPolicy: ClusterFirst
      hostPID: true
      imagePullSecrets:
      - name: aqua-registry
      restartPolicy: Always
      schedulerName: default-scheduler
      serviceAccount: aqua-sa
      serviceAccountName: aqua-sa
      terminationGracePeriodSeconds: 30
      volumes:
      - hostPath:
          path: /var/run
          type: ""
        name: var-run
      - hostPath:
          path: /dev
          type: ""
        name: dev
      - hostPath:
          path: /sys
          type: ""
        name: sys
      - hostPath:
          path: /proc
          type: ""
        name: proc
      - hostPath:
          path: /etc
          type: ""
        name: etc
      - hostPath:
          path: /var/lib/aquasec
          type: ""
        name: aquasec
      - hostPath:
          path: /var/lib/aquasec/tmp
          type: ""
        name: aquasec-tmp
      - hostPath:
          path: /var/lib/aquasec/audit
          type: ""
        name: aquasec-audit
      - hostPath:
          path: /var/lib/aquasec/data
          type: ""
        name: aquasec-data
      # - name: aqua-grpc-enforcer
      #   secret:
      #     secretName: aqua-grpc-enforcer
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
