scanner-deployment.yaml

---
apiVersion: apps/v1
{{- if .Values.persistence.enabled }}
kind: StatefulSet
{{- else }}
kind: Deployment
{{- end }}
metadata:
  name: {{ .Release.Name }}-scanner
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Release.Name }}-scanner
    aqua.component: scanner
{{ include "aqua.labels" . | indent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
{{- if .Values.persistence.enabled }}
  serviceName: {{ .Release.Name }}-scanner
{{- end }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-scanner
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/scanner-configmap.yaml") . | sha256sum }}
      {{- if and (.Values.tolerations) (semverCompare "<1.6-0" .Capabilities.KubeVersion.GitVersion) }}
        scheduler.alpha.kubernetes.io/tolerations: '{{ toJson .Values.tolerations }}'
      {{- end }}
      {{- with .Values.podAnnotations }}
      {{- range $key,$value := . }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      {{- end }}
      labels:
        app: {{ .Release.Name }}-scanner
        aqua.component: scanner
        {{- range $key, $value := .Values.podLabels }}
        {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }}
        {{- end }}
{{ include "aqua.labels" . | indent 8 }}
      name: {{ .Release.Name }}-scanner
    spec:
      {{- with .Values.securityContext }}
      securityContext:
{{ toYaml . | indent 8 }}
      {{- end }}
      serviceAccount: {{ template "serviceAccount" . }}
      containers:
      - name: scanner
        {{- with .Values.container_securityContext }}
        securityContext:
{{ toYaml . | indent 10 }}
        {{- end }}
        image: "{{ .Values.imageCredentials.repositoryUriPrefix }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: "{{ .Values.image.pullPolicy }}"
        args:
        - daemon
        {{- if .Values.directCC.enabled }}
        - --direct-cc
        {{- end }}
        {{- if or (eq .Values.scannerTokenSecret.enable true) .Values.scannerToken }}
        - --token
        - "$(SCANNER_TOKEN)"
        {{- else }}
        - --user
        {{- if .Values.scannerUserSecret.enable }}
        - "$(SCANNER_USER)"
        {{- else }}
        - {{ required "Please specify a username associated with the Scanner role" .Values.user }}
        {{- end }}
        - --password
        {{- if .Values.scannerUserSecret.enable }}
        - "$(SCANNER_PASSWORD)"
        {{- else }}
        - {{ required "Please specify a password for a user associated with the Scanner role" .Values.password | squote }}
        {{- end }}
        {{- end }}
        - --host
        - "{{ .Values.server.scheme | default "http" }}://{{ .Values.server.serviceName }}:{{ .Values.server.port }}"
        {{- if or ( .Values.serverSSL.enable ) ( .Values.cyberCenter.mtls.enabled  ) }}
        {{- else }}
        - --no-verify
        {{- end }}
        {{- if .Values.registries }}
        - --registries
        - {{ join "," .Values.registries }}
        {{- end }}
        envFrom:
        - configMapRef:
            name: {{ .Release.Name }}-scanner-config
        env:
        - name: AQUA_SCANNER_LOGICAL_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        {{- if .Values.scannerUserSecret.enable }}
          {{- if or  (not .Values.scannerUserSecret.secretName) (not .Values.scannerUserSecret.passwordKey) (not .Values.scannerUserSecret.userKey) }}
          {{- template "scannerSecret" . }}
          {{- else }}
        - name: SCANNER_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ .Values.scannerUserSecret.secretName }}
              key: {{ .Values.scannerUserSecret.passwordKey }}
        - name: SCANNER_USER
          valueFrom:
            secretKeyRef:
              name: {{ .Values.scannerUserSecret.secretName }}
              key: {{ .Values.scannerUserSecret.userKey }}
          {{- end }}
        {{- end }}
        {{- if or (eq .Values.scannerTokenSecret.enable true) .Values.scannerToken }}
        - name: SCANNER_TOKEN
          valueFrom:
            secretKeyRef:
              {{- if .Values.scannerTokenSecret.enable }}
              key: {{ .Values.scannerTokenSecret.tokenKey }}
              name: {{ .Values.scannerTokenSecret.secretName }}
              {{- else }}
              key: token
              name: {{ .Release.Name }}-token-secret
              {{- end }}
        {{- end }}
        {{- include "scanner.extraEnvironmentVars" .Values | nindent 8 }}
        {{- include "scanner.extraSecretEnvironmentVars" .Values | nindent 8 }}
        volumeMounts:
        {{- if or (.Values.dockerSock.mount) (.Values.serverSSL.enable) (.Values.cyberCenter.mtls.enabled) (.Values.additionalCerts) (.Values.persistence.enabled) }}
        {{- end }}
        {{- with .Values.extraVolumeMounts }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
        {{- if .Values.dockerSock.mount }}
        - mountPath: /var/run/docker.sock
          name: docker-socket-mount
        {{- end }}
        {{- if .Values.serverSSL.enable }}
        - mountPath: /etc/ssl/certs/aqua-ssl.crt
          name: ssl-certs
        {{- end }}
        {{- if .Values.cyberCenter.mtls.enabled }}
        - name: cc-mtls-certs
          mountPath: /opt/aquasec/ssl/
          readOnly: true
        {{- end }}
        {{- if .Values.persistence.enabled }}
        - name: scanner-pvc
          mountPath: /opt/aquascans
        {{- end }}
        {{- include "scanner.additionalCertVolumeMounts" .Values | nindent 8 }}
        ports:
        - containerPort: 8080
          protocol: TCP
{{- with .Values.livenessProbe }}
        livenessProbe:
{{ toYaml . | indent 10 }}
{{- end }}
{{- with .Values.readinessProbe }}
        readinessProbe:
{{ toYaml . | indent 10 }}
{{- end }}
        resources:
{{ toYaml .Values.resources | indent 10 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{ toYaml . | nindent 6 }}
      {{- end }}
      volumes:
      {{- if or (.Values.dockerSock.mount) (.Values.serverSSL.enable) (.Values.cyberCenter.mtls.enabled) (.Values.additionalCerts) (.Values.persistence.enabled) }}
      {{- end }}
      {{- with .Values.extraVolumes }}
        {{- toYaml . | nindent 6 }}
      {{- end }}
      {{- if .Values.dockerSock.mount }}
      - name: docker-socket-mount
        hostPath:
          path: {{ .Values.dockerSock.path }}
      {{- end }}
      {{- if .Values.serverSSL.enable }}
      - name: ssl-certs
        secret:
          secretName: {{ .Values.serverSSL.secretName }}
          items:
          {{- if .Values.serverSSL.createSecret }}
            - key: aqua-ssl.crt
          {{- else }}
            - key: {{ .Values.serverSSL.certFile }}
          {{- end }}
              path: aqua-ssl.crt
      {{- end }}
      {{- if .Values.cyberCenter.mtls.enabled }}
      - name: cc-mtls-certs
        secret:
          defaultMode: 420
          secretName: {{ .Values.cyberCenter.mtls.secretName}}
          items:
          - key: {{ .Values.cyberCenter.mtls.publicKey_fileName }}
            path: cert.pem
          - key: {{ .Values.cyberCenter.mtls.privateKey_fileName }}
            path: key.pem
          {{- if .Values.cyberCenter.mtls.rootCA_fileName }}
          - key: {{ .Values.cyberCenter.mtls.rootCA_fileName }}
            path: ca.pem
          {{- end }}
      {{- end }}
      {{- include "scanner.additionalCertVolumes" .Values | nindent 6 }}
      {{- if .Values.persistence.enabled }}
      - name: scanner-pvc
        persistentVolumeClaim:
          claimName: {{ .Release.Name }}-scanner-pvc
      {{- end -}}