## This is an example scan Job that is scheduled to scan the specified image with Aqua CSP scanner.
## It attempts to fetch the vulnerability report with the Aqua API. If the vulnerability reports
## is not found, it runs the `scannercli scan` command.
## Finally, it outputs the vulnerability report as JSON to the stdout.
apiVersion: batch/v1
kind: Job
metadata:
  name: scan-job
  namespace: starboard-operator
spec:
  template:
    spec:
      serviceAccountName: starboard-operator
      volumes:
        - name: scannercli
          emptyDir: {}
        - name: dockersock
          hostPath:
            ## TODO This works only for Docker container runtime
            path: "/var/run/docker.sock"
      initContainers:
        - name: download
          image: aquasec/scanner:5.0
          command:
            - cp
            - "/opt/aquasec/scannercli"
            - "/downloads/scannercli"
          volumeMounts:
            - name: scannercli
              mountPath: /downloads
      containers:
        - name: scanner
          image: docker.io/aquasec/starboard-scanner-aqua:dev
          imagePullPolicy: IfNotPresent
          command:
            - "/bin/sh"
            - "-c"
            - "/usr/local/bin/starboard-scanner-aqua --host $(OPERATOR_SCANNER_AQUA_CSP_HOST) --user $(OPERATOR_SCANNER_AQUA_CSP_USERNAME) --password $(OPERATOR_SCANNER_AQUA_CSP_PASSWORD) $(IMAGE_REF) 2> /dev/termination-log"
          env:
            - name: IMAGE_REF
              value: nginx:1.16
            - name: OPERATOR_SCANNER_AQUA_CSP_HOST
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_HOST
            - name: OPERATOR_SCANNER_AQUA_CSP_USERNAME
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_USERNAME
            - name: OPERATOR_SCANNER_AQUA_CSP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: starboard-operator
                  key: OPERATOR_SCANNER_AQUA_CSP_PASSWORD
          volumeMounts:
            - name: scannercli
              mountPath: /usr/local/bin/scannercli
              subPath: scannercli
            - name: dockersock
              mountPath: "/var/run/docker.sock"
      restartPolicy: Never
  backoffLimit: 0
