apiVersion: v1
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""
items:
- apiVersion: v1
  kind: Secret
  metadata:
    name: vault-secret
  type: Opaque
  stringData:
    HOST: "http://vault.vault:8200"
    USER: "sourcesense"
    PWD: "{{ vault_password }}"
- apiVersion: v1
  kind: ConfigMap
  metadata:
    name: {{ name }}-sentinel-tasks-cm
  data:
    tasks.json: |{% raw %}
      {
        "tasks": [
          {
            "name": "kubelinter",
            "module": "sentinel.tasks.kubelinter.KubeLinter",
            "enabled": true,
            "scheduled": 3600
          },
          {
            "name": "kubecounter",
            "module": "sentinel.tasks.kubecounter.KubeCounter",
            "enabled": true,
            "scheduled": 3600
          },
          {
            "name": "anchore",
            "module": "sentinel.tasks.anchore.Anchore",
            "enabled": true,
            "scheduled": 3600
          }
        ]
      }{% endraw %}
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: {{ name }}-sentinel
  spec:
    selector:
      matchLabels:
        app: {{ name }}-sentinel
    replicas: 1
    template:
      metadata:
        name: {{ name }}-sentinel
        labels:
          app: {{ name }}-sentinel
      spec:
        volumes:
          - name: tasks-volume
            configMap:
              name: {{ name }}-sentinel-tasks-cm
        containers:
        - name: {{ name }}-sentinel
          image: docker-registry.oc.corp.sourcesense.com/daas/workstation-sentinel:{{ tag }}
          volumeMounts:
            - name: tasks-volume
              mountPath: /etc/custom
          env:
          - name: CLUSTER_TOKEN
            value: {{ token }}
          - name: TASKS_JSON
            value: /etc/custom/tasks.json 
          - name: KUBE_DISTRIBUTION
            value: {{ distribution }}
          - name: VAULT_HOST
            valueFrom:
              secretKeyRef:
                name: vault-secret
                key: HOST
          - name: VAULT_USER
            valueFrom:
              secretKeyRef:
                name: vault-secret
                key: USER
          - name: VAULT_PWD
            valueFrom:
              secretKeyRef:
                name: vault-secret
                key: PWD
          - name: ANCHORE_URL
            value: http://anchore-anchore-engine-api.anchore.svc:8228
          - name: ANCHORE_USERNAME
            value: admin
          - name: ANCHORE_PWD
            valueFrom:
              secretKeyRef:
                name: anchore-password
                key: ANCHORE_PWD
          - name: BEAT_OUTPUT
            value: filebeat.daas.svc:9000
        imagePullSecrets:
        - name: sourcesense-registry
- apiVersion: v1
  kind: Service
  metadata:
    labels:
      app: {{ name }}-sentinel
    name: {{ name }}-sentinel
  spec:
    ports:
    - name: 8089-tcp
      port: 8089
      protocol: TCP
      targetPort: 8089
    selector:
      app: {{ name }}-sentinel
    sessionAffinity: None
    type: ClusterIP
- apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: {{ name }}-sentinel-ingress
  spec:
    rules:
    - host: {{ name }}-sentinel.local
      http:
        paths:
        - backend:
            serviceName: {{ name }}-sentinel
            servicePort: 8089
          path: /