apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: scanner
  namespace: openshift-scanning
spec:
  selector:
    matchLabels:
      name: scanner
  template:
    metadata:
      labels:
        name: scanner
    spec:
      containers:
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        image: quay.io/dedgar/clamsig-puller:v0.0.4
        name: clamsig-puller
        resources:
          limits:
            cpu: 100m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 50Mi
        volumeMounts:
        - mountPath: /secrets
          name: clam-secrets
        - mountPath: /clam
          name: clam-files
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        image: quay.io/dedgar/clamd:v0.0.3
        name: clamd
        resources:
          limits:
            cpu: 300m
            memory: 1Gi
          requests:
            cpu: 100m
            memory: 600Mi
        volumeMounts:
        - mountPath: /var/lib/clamav
          name: clam-files
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        - name: CHROOT_PATH
          value: /host
        image: quay.io/dedgar/container-info:v0.0.15
        name: info
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
          requests:
            cpu: 100m
            memory: 20Mi
        securityContext:
          privileged: true
          runAsUser: 0
        volumeMounts:
        - mountPath: /clam
          name: clam-files
        - mountPath: /host
          name: host-filesystem
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        - name: ACTIVE_SCAN
          value: "true"
        - name: CRIO_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/crio/log
        - name: DOCKER_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/docker/log
        - name: CLAM_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/clam/scanresult
        - name: JOURNAL_PATH
          value: /var/log/journal
        - name: SCAN_RESULTS_DIR
        - name: POST_RESULT_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/clam/scanresult
        - name: OUT_FILE
        - name: SKIP_NAMESPACE_PREFIXES
          value: openshift-
        - name: SKIP_NAMESPACES
          value: openshift-scanning,ci
        - name: CLAM_SOCKET
          value: /clam/clamd.sock
        - name: INFO_SOCKET
          value: '@rpc.sock'
        image: quay.io/dedgar/watcher:v0.0.67
        name: watcher
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 100m
            memory: 50Mi
        securityContext:
          privileged: true
          runAsUser: 0
        volumeMounts:
        - mountPath: /secrets
          name: clam-secrets
        - mountPath: /var/log/journal
          name: watcher-host-journal
        - mountPath: /host
          name: host-filesystem
        - mountPath: /clam
          name: clam-files
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        - name: CRIO_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/crio/log
        - name: DOCKER_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/docker/log
        - name: CLAM_LOG_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/clam/scanresult
        - name: JOURNAL_PATH
          value: /var/log/journal
        - name: SCAN_RESULTS_DIR
        - name: POST_RESULT_URL
          value: http://loggerservice.openshift-scanning.svc.cluster.local:8080/api/clam/scanresult
        - name: OUT_FILE
        - name: CLAM_SOCKET
          value: /clam/clamd.sock
        - name: INFO_SOCKET
          value: '@rpc.sock'
        - name: SCHEDULED_SCAN
          value: "true"
        - name: SCHEDULED_SCAN_DAY
          value: Saturday
        - name: MIN_CON_DAY
          value: "0"
        - name: SKIP_NAMESPACE_PREFIXES
          value: openshift-
        - name: SKIP_NAMESPACES
          value: openshift-scanning
        - name: HOST_SCAN_DIRS
          value: /host
        image: quay.io/dedgar/watcher:v0.0.67
        name: scheduler
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 100m
            memory: 50Mi
        securityContext:
          privileged: true
          runAsUser: 0
        volumeMounts:
        - mountPath: /var/log/journal
          name: watcher-host-journal
        - mountPath: /host
          name: host-filesystem
        - mountPath: /clam
          name: clam-files
      dnsPolicy: ClusterFirst
      initContainers:
      - env:
        - name: OO_PAUSE_ON_START
          value: "false"
        - name: INIT_CONTAINER
          value: "true"
        image: quay.io/dedgar/clamsig-puller:v0.0.4
        name: init-clamsig-puller
        resources:
          limits:
            cpu: 100m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 50Mi
        volumeMounts:
        - mountPath: /secrets
          name: clam-secrets
        - mountPath: /clam
          name: clam-files
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: scanner-sa
      tolerations:
      - operator: Exists
      volumes:
      - name: clam-secrets
        secret:
          secretName: clam-secrets
      - emptyDir: {}
        name: clam-files
      - hostPath:
          path: /
          type: ""
        name: host-filesystem
      - hostPath:
          path: /var/log/journal
          type: ""
        name: watcher-host-journal
