---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: aqua-agent
  name: aqua-agent
spec:
  selector:
    matchLabels:
      app: aqua-agent
  template:
    metadata:
      labels:
        app: aqua-agent
      name: aqua-agent
      annotations:
        container.apparmor.security.beta.kubernetes.io/aqua-agent: unconfined
    spec:
      serviceAccount: aqua-sa
      hostPID: true
      restartPolicy: Always
      containers:
      - name: aqua-agent
        image: registry.aquasec.com/enforcer:5.3
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
        env:
        - name: AQUA_TOKEN
          value: <installation_token>
        - name: AQUA_SERVER
          value: aqua-gateway:8443
        # replace for using envoy service
        # - name: AQUA_SERVER
        #   value: aqua-lb:443
        # if envoy working with certificate
        # - name: AQUA_TLS_VERIFY
        #   value: "true"
        - name: RESTART_CONTAINERS
          value: "no"
        volumeMounts:
        # for envoy certificates
        # - mountPath: /etc/ssl/custom-certificates/aqua-ca.pem
        #   name: ca-certs
        #   subPath: aqua-ca.pem
        #   readOnly: true
        - mountPath: /var/run
          name: var-run
        - mountPath: /dev
          name: dev
        - mountPath: /host/sys
          name: sys
          readOnly: true
        - mountPath: /host/proc
          name: proc
          readOnly: true
        - mountPath: /host/etc
          name: etc
          readOnly: true
        - mountPath: /host/opt/aquasec
          name: aquasec
          readOnly: true
        - mountPath: /opt/aquasec/tmp
          name: aquasec-tmp
        - mountPath: /opt/aquasec/audit
          name: aquasec-audit
        - mountPath: /data
          name: aquasec-data
      volumes:
      # - name: ca-certs
      #   configMap:
      #     name: agent-crt
      - name: var-run
        hostPath:
          path: /var/run
      - name: dev
        hostPath:
          path: /dev
      - name: sys
        hostPath:
          path: /sys
      - name: proc
        hostPath:
          path: /proc
      - name: etc
        hostPath:
          path: /etc
      - name: aquasec
        hostPath:
          path: /var/lib/aquasec
      - name: aquasec-tmp
        hostPath:
          path: /var/lib/aquasec/tmp
      - name: aquasec-audit
        hostPath:
          path: /var/lib/aquasec/audit
      - name: aquasec-data
        hostPath:
          path: /var/lib/aquasec/data