ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/quay/clair.yaml

@@ -0,0 +1,232 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: quay-registry-clair
+  namespace: quay
+  labels:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: quay-registry
+    app.kubernetes.io/component: security-scanner
+    quay-operator/quayregistry: quay-registry
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: quay-registry-clair-app
+  namespace: quay
+  labels:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: quay-registry
+    app.kubernetes.io/component: security-scanner
+    quay-component: clair-app
+    quay-operator/quayregistry: quay-registry
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: quay-registry
+    app.kubernetes.io/component: security-scanner
+    quay-component: clair-app
+    quay-operator/quayregistry: quay-registry
+  ports:
+    - name: clair-http
+      port: 80
+      protocol: TCP
+      targetPort: clair-http
+    - name: clair-introspection
+      port: 8089
+      protocol: TCP
+      targetPort: clair-intro
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: quay-registry-clair
+  namespace: quay
+  labels:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: quay-registry
+    app.kubernetes.io/component: security-scanner
+    quay-component: clair-app
+    quay-operator/quayregistry: quay-registry
+spec:
+  replicas: 2
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: clair
+      app.kubernetes.io/instance: quay-registry
+      app.kubernetes.io/component: security-scanner
+      quay-component: clair-app
+      quay-operator/quayregistry: quay-registry
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: clair
+        app.kubernetes.io/instance: quay-registry
+        app.kubernetes.io/component: security-scanner
+        quay-component: clair-app
+        quay-operator/quayregistry: quay-registry
+    spec:
+      serviceAccountName: quay-registry-clair
+      imagePullSecrets:
+        - name: quay-cluster-pull
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        fsGroup: 65534
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: has-zfs
+                    operator: In
+                    values:
+                      - "true"
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: quay-component
+                      operator: In
+                      values:
+                        - clair-app
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: clair
+              app.kubernetes.io/instance: quay-registry
+              app.kubernetes.io/component: security-scanner
+              quay-component: clair-app
+              quay-operator/quayregistry: quay-registry
+      containers:
+        - name: clair-app
+          image: registry.quorate.internal/quorate/clair@sha256:b3040b6c61df5b6a261c981d2fb9c794244879b01e9842806cb8f11dbdc28bde
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          env:
+            - name: CLAIR_CONF
+              value: /clair/config.yaml
+            - name: CLAIR_MODE
+              value: combo
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: clair-db
+                  key: password
+            - name: SSL_CERT_FILE
+              value: /var/run/certs/internal-ca.crt
+          ports:
+            - name: clair-http
+              containerPort: 8080
+              protocol: TCP
+            - name: clair-intro
+              containerPort: 8089
+              protocol: TCP
+          startupProbe:
+            tcpSocket:
+              port: clair-intro
+            failureThreshold: 300
+            periodSeconds: 10
+            timeoutSeconds: 1
+          readinessProbe:
+            tcpSocket:
+              port: clair-http
+            failureThreshold: 3
+            periodSeconds: 10
+            timeoutSeconds: 1
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: clair-intro
+              scheme: HTTP
+            failureThreshold: 3
+            periodSeconds: 10
+            timeoutSeconds: 1
+          resources:
+            requests:
+              cpu: "2"
+              memory: 2Gi
+            limits:
+              cpu: "4"
+              memory: 16Gi
+          volumeMounts:
+            - name: config
+              mountPath: /clair/config.yaml
+              subPath: config.yaml
+              readOnly: true
+            - name: internal-ca
+              mountPath: /var/run/certs/internal-ca.crt
+              subPath: internal-ca.crt
+              readOnly: true
+            - name: indexer-layer-storage
+              mountPath: /var/tmp
+      volumes:
+        - name: config
+          secret:
+            secretName: quay-config-bundle
+            items:
+              - key: clair-config.yaml
+                path: config.yaml
+        - name: internal-ca
+          secret:
+            secretName: quay-config-bundle
+            items:
+              - key: extra_ca_cert_internal-ca.crt
+                path: internal-ca.crt
+        - name: indexer-layer-storage
+          emptyDir:
+            sizeLimit: 20Gi
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: quay-registry-clair-app
+  namespace: quay
+  labels:
+    app.kubernetes.io/name: clair
+    app.kubernetes.io/instance: quay-registry
+    app.kubernetes.io/component: security-scanner
+    quay-operator/quayregistry: quay-registry
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: quay-registry-clair
+  minReplicas: 2
+  maxReplicas: 2
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 90
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 90