apiVersion: apps/v1
kind: Deployment
metadata:
  name: aqua-kube-enforcer
  namespace: aqua
  labels:
    app: aqua-kube-enforcer
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: aqua-kube-enforcer
    spec:
      serviceAccountName: aqua-kube-enforcer-sa
      containers:
        - name: kube-enforcer
          image: registry.aquasec.com/kube-enforcer:5.0
          imagePullPolicy: Always
          ports:
            - containerPort: 8443
          env:
            - name: AQUA_TOKEN
              valueFrom:
                secretKeyRef:
                  name: aqua-kube-enforcer-token
                  key: token
            # Specify whether to enable/disable the cache by using "yes", "true", "no", "false" values.
            # Default value is "yes".
            - name: AQUA_ENABLE_CACHE
              value: "yes"
            # Specify cache expiration period in seconds.
            # Default value is 60
            - name: AQUA_CACHE_EXPIRATION_PERIOD
              value: "60"
            - name: TLS_SERVER_CERT_FILEPATH
              value: /certs/server.crt
            - name: TLS_SERVER_KEY_FILEPATH
              value: /certs/server.key
            # Specify the gateway address if it's different
            # from default one.  
            - name: AQUA_GATEWAY_SECURE_ADDRESS
              value: aqua-gateway:8443
            - name: AQUA_TLS_PORT
              value: "8443"
            # Specify the cluster name else
            # kube-enforcer will gnerate name for you.  
            - name: CLUSTER_NAME
              value: ""
          volumeMounts:
            - name: "certs"
              mountPath: "/certs"
      volumes:
        - name: "certs"
          secret:
            secretName: "aqua-kube-enforcer-certs"
      imagePullSecrets:
        - name: aqua-registry
  selector:
    matchLabels:
      app: aqua-kube-enforcer