enforcer-daemonset.yaml

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ .Release.Name }}-ds
  labels:
    app: {{ .Release.Name }}-ds
    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
      app: {{ .Release.Name }}-ds
  template:
    metadata:
      annotations:
      {{- if not .Values.securityContext.privileged }}
        container.apparmor.security.beta.kubernetes.io/enforcer: unconfined
      {{- end }}
      {{- if and (.Values.tolerations) (semverCompare "<1.6-0" .Capabilities.KubeVersion.GitVersion) }}
        scheduler.alpha.kubernetes.io/tolerations: '{{ toJson .Values.tolerations }}'
      {{- end }}
      labels:
        app: {{ .Release.Name }}-ds
      name: {{ .Release.Name }}-ds
    spec:
      serviceAccount: {{ .Release.Name }}-sa
      hostPID: true
      containers:
      - name: enforcer
        image: "{{ .Values.imageCredentials.repositoryUriPrefix }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: "{{ .Values.image.pullPolicy }}"
        securityContext:
          {{- toYaml .Values.securityContext | nindent 12 }}
        env:
        - name: SCALOCK_LOG_LEVEL
          value: {{ .Values.logLevel | default "INFO" }}
        {{- if .Values.enforcerTokenSecretName }}
        - name: AQUA_TOKEN
          valueFrom:
            secretKeyRef:
              name: {{ .Values.enforcerTokenSecretName }}
              key: {{ .Values.enforcerTokenSecretKey }}
        {{- else }}
        - name: AQUA_TOKEN
          valueFrom:
            secretKeyRef:
              name: {{ .Release.Name }}-token
              key: token
        {{- end }}
        - name: AQUA_SERVER
          value: {{ .Values.gate.host | default "aqua-gateway-svc" }}:{{ .Values.gate.port | default "8443" }}
        - name: AQUA_INSTALL_PATH
          value: /var/lib/aquasec
          {{- if .Values.enforcerLogicalName }}
        - name: AQUA_LOGICAL_NAME
          value: {{ .Values.enforcerLogicalName }}
          {{- else }}
        - name: AQUA_LOGICAL_NAME
          value: {{ .Release.Name }}-helm
          {{- end }}
          {{- if .Values.hostRunPath }}
        - name: AQUA_HOST_RUN_PATH
          value: {{ .Values.hostRunPath }}
          {{- end }}
        {{- include "enforcer.extraEnvironmentVars" .Values | nindent 8 }}
        {{- include "enforcer.extraSecretEnvironmentVars" .Values | nindent 8 }}
        volumeMounts:
        {{ if .Values.envoy.enabled }}
        {{ if .Values.envoy.configMap }}
        - name: ca-certs
          mountPath: /etc/ssl/custom-certificates/
          readOnly: true
        {{- end }}
        {{- end }}
        - mountPath: /var/run
          name: var-run
        - mountPath: /dev
          name: dev
        - mountPath: /host/sys
          name: sys
          readOnly: true
        - mountPath: /host/proc
          name: proc
          readOnly: true
        - mountPath: /host/etc
          name: etc
          readOnly: true
        - mountPath: /host/opt/aquasec
          name: aquasec
          readOnly: true
        - mountPath: /opt/aquasec/tmp
          name: aquasec-tmp
        - mountPath: /opt/aquasec/audit
          name: aquasec-audit
        - mountPath: /data
          name: aquasec-data
{{- with .Values.livenessProbe }}
        livenessProbe:
{{ toYaml . | indent 10 }}
{{- end }}
{{- with .Values.readinessProbe }}
        readinessProbe:
{{ toYaml . | indent 10 }}
{{- end }}
        resources:
{{ toYaml .Values.resources | indent 12 }}
      volumes:
      {{- if .Values.hostRunPath }}
      - name: var-run
        hostPath:
          path: {{ .Values.hostRunPath }}
      {{- else }}
      - name: var-run
        hostPath:
          path: /var/run
      {{- end }}
      - name: dev
        hostPath:
          path: /dev
      - name: sys
        hostPath:
          path: /sys
      - name: proc
        hostPath:
          path: /proc
      - name: etc
        hostPath:
          path: /etc
      - name: aquasec
        hostPath:
          path: /var/lib/aquasec
      - name: aquasec-tmp
        hostPath:
          path: /var/lib/aquasec/tmp
      - name: aquasec-audit
        hostPath:
          path: /var/lib/aquasec/audit
      - name: aquasec-data
        hostPath:
          path: /var/lib/aquasec/data
      {{ if .Values.envoy.enabled }}
      {{ if .Values.envoy.configMap }}
      - name: ca-certs
        configMap:
          name: {{ .Values.envoy.configMap }}
      {{- end }}
      {{- end }}
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if and (.Values.tolerations) (semverCompare "^1.6-0" .Capabilities.KubeVersion.GitVersion) }}
      tolerations:
{{ toYaml .Values.tolerations | indent 6 }}
      {{- end }}