apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: vector-audit-log
  namespace: api-audit-log
  labels:
    k8s-app: vector-audit-log
spec:
  selector:
    matchLabels:
      k8s-app: vector-audit-log
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: vector-audit-log
        configmap-update: "5"
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      dnsPolicy: Default
      containers:
      - name: vector-audit-log
        image: quay.io/alvaroaleman/vector:0.14.X-alpine
        env:
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: aws-ci-infra-ci-build02-audit-logs-uploader-credentials
              key: AWS_ACCESS_KEY_ID
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: aws-ci-infra-ci-build02-audit-logs-uploader-credentials
              key: AWS_SECRET_ACCESS_KEY
        securityContext:
          privileged: true
        resources:
          requests:
            cpu: 100m
            memory: 300Mi
        volumeMounts:
        - name: varlog
          mountPath: /host/var/log
          readOnly: true
        - name: config-volume
          mountPath: /etc/vector
          readOnly: true
        - name: data-volume
          mountPath: /var/lib/vector
      nodeSelector:
        node-role.kubernetes.io/master: ""
      serviceAccountName: logging-app
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: config-volume
        configMap:
          name: vector-audit-log-config
      - name: data-volume
        hostPath:
          path: /var/lib/vector
          type: DirectoryOrCreate
