apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: suricata
  namespace: openshift-suricata
spec:
  selector:
    matchLabels:
      name: suricata
  template:
    metadata:
      labels:
        name: suricata
    spec:
      containers:
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        image: quay.io/app-sre/suricata@sha256:5ff22c23a4f7705d4d5c2d53065bee0732a5a40220396e4b157fe7f3e6ffbd80
        imagePullPolicy: IfNotPresent
        name: suricata
        resources:
          limits:
            cpu: 900m
            memory: 900Mi
          requests:
            cpu: 100m
            memory: 50Mi
        securityContext:
          privileged: true
          runAsUser: 0
        volumeMounts:
        - mountPath: /host/
          name: host-filesystem
      - name: log-cleaner
        image: quay.io/app-sre/log-cleaner@sha256:8a76d5d3ac28e29bb1443e761c55102df55d7bdacf867484035f2b2f251cd299
        volumeMounts:
        - mountPath: /host/
          name: host-filesystem        
      dnsPolicy: ClusterFirst
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: suricata-sa
      tolerations:
      - operator: Exists
      volumes:
      - hostPath:
          path: /
        name: host-filesystem
