---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: aqua-agent
  name: aqua-agent
spec:
  selector:
    matchLabels:
      app: aqua-agent
  template:
    metadata:
      labels:
        app: aqua-agent
      name: aqua-agent
    spec:
      serviceAccount: aqua-sa
      hostPID: true
      restartPolicy: Always
      containers:
      - name: aqua-agent
        image: registry.aquasec.com/enforcer:4.6
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: false
          capabilities:
              add:
                - SYS_ADMIN
                - NET_ADMIN
                - NET_RAW
                - SYS_PTRACE
                - KILL
                - MKNOD
                - SETGID
                - SETUID
                - SYS_MODULE
                - AUDIT_CONTROL
                - SYSLOG
                - SYS_CHROOT
        env:
        - name: AQUA_TOKEN
          value: <installation_token>
        - name: AQUA_SERVER
          value: aqua-gateway:8443
        - name: AQUA_HOST_RUN_PATH
          value: /var/vcap/sys/run/docker
        - name: RESTART_CONTAINERS
          value: "no"
        volumeMounts:
        - mountPath: /var/run
          name: var-run
        - mountPath: /dev
          name: dev
        - mountPath: /host/sys
          name: sys
          readOnly: true
        - mountPath: /host/proc
          name: proc
          readOnly: true
        - mountPath: /host/etc
          name: etc
          readOnly: true
        - mountPath: /host/opt/aquasec
          name: aquasec
          readOnly: true
        - mountPath: /opt/aquasec/tmp
          name: aquasec-tmp
        - mountPath: /opt/aquasec/audit
          name: aquasec-audit
        - mountPath: /data
          name: aquasec-data
      volumes:
      - name: var-run
        hostPath:
          path: /var/vcap/sys/run/docker 
      - name: dev
        hostPath:
          path: /dev
      - name: sys
        hostPath:
          path: /sys
      - name: proc
        hostPath:
          path: /proc
      - name: etc
        hostPath:
          path: /etc
      - name: aquasec
        hostPath:
          path: /var/lib/aquasec
      - name: aquasec-tmp
        hostPath:
          path: /var/lib/aquasec/tmp
      - name: aquasec-audit
        hostPath:
          path: /var/lib/aquasec/audit
      - name: aquasec-data
        hostPath:
          path: /var/lib/aquasec/data
