---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: quay-registry-clair
  namespace: quay
  labels:
    app.kubernetes.io/name: clair
    app.kubernetes.io/instance: quay-registry
    app.kubernetes.io/component: security-scanner
    quay-operator/quayregistry: quay-registry
---
apiVersion: v1
kind: Service
metadata:
  name: quay-registry-clair-app
  namespace: quay
  labels:
    app.kubernetes.io/name: clair
    app.kubernetes.io/instance: quay-registry
    app.kubernetes.io/component: security-scanner
    quay-component: clair-app
    quay-operator/quayregistry: quay-registry
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: clair
    app.kubernetes.io/instance: quay-registry
    app.kubernetes.io/component: security-scanner
    quay-component: clair-app
    quay-operator/quayregistry: quay-registry
  ports:
    - name: clair-http
      port: 80
      protocol: TCP
      targetPort: clair-http
    - name: clair-introspection
      port: 8089
      protocol: TCP
      targetPort: clair-intro
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: quay-registry-clair
  namespace: quay
  labels:
    app.kubernetes.io/name: clair
    app.kubernetes.io/instance: quay-registry
    app.kubernetes.io/component: security-scanner
    quay-component: clair-app
    quay-operator/quayregistry: quay-registry
spec:
  replicas: 2
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: clair
      app.kubernetes.io/instance: quay-registry
      app.kubernetes.io/component: security-scanner
      quay-component: clair-app
      quay-operator/quayregistry: quay-registry
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
  template:
    metadata:
      labels:
        app.kubernetes.io/name: clair
        app.kubernetes.io/instance: quay-registry
        app.kubernetes.io/component: security-scanner
        quay-component: clair-app
        quay-operator/quayregistry: quay-registry
    spec:
      serviceAccountName: quay-registry-clair
      imagePullSecrets:
        - name: quay-cluster-pull
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                  - key: has-zfs
                    operator: In
                    values:
                      - "true"
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: quay-component
                      operator: In
                      values:
                        - clair-app
                topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: clair
              app.kubernetes.io/instance: quay-registry
              app.kubernetes.io/component: security-scanner
              quay-component: clair-app
              quay-operator/quayregistry: quay-registry
      containers:
        - name: clair-app
          image: registry.quorate.internal/quorate/clair@sha256:b3040b6c61df5b6a261c981d2fb9c794244879b01e9842806cb8f11dbdc28bde
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          env:
            - name: CLAIR_CONF
              value: /clair/config.yaml
            - name: CLAIR_MODE
              value: combo
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: clair-db
                  key: password
            - name: SSL_CERT_FILE
              value: /var/run/certs/internal-ca.crt
          ports:
            - name: clair-http
              containerPort: 8080
              protocol: TCP
            - name: clair-intro
              containerPort: 8089
              protocol: TCP
          startupProbe:
            tcpSocket:
              port: clair-intro
            failureThreshold: 300
            periodSeconds: 10
            timeoutSeconds: 1
          readinessProbe:
            tcpSocket:
              port: clair-http
            failureThreshold: 3
            periodSeconds: 10
            timeoutSeconds: 1
          livenessProbe:
            httpGet:
              path: /healthz
              port: clair-intro
              scheme: HTTP
            failureThreshold: 3
            periodSeconds: 10
            timeoutSeconds: 1
          resources:
            requests:
              cpu: "2"
              memory: 2Gi
            limits:
              cpu: "4"
              memory: 16Gi
          volumeMounts:
            - name: config
              mountPath: /clair/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: internal-ca
              mountPath: /var/run/certs/internal-ca.crt
              subPath: internal-ca.crt
              readOnly: true
            - name: indexer-layer-storage
              mountPath: /var/tmp
      volumes:
        - name: config
          secret:
            secretName: quay-config-bundle
            items:
              - key: clair-config.yaml
                path: config.yaml
        - name: internal-ca
          secret:
            secretName: quay-config-bundle
            items:
              - key: extra_ca_cert_internal-ca.crt
                path: internal-ca.crt
        - name: indexer-layer-storage
          emptyDir:
            sizeLimit: 20Gi
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: quay-registry-clair-app
  namespace: quay
  labels:
    app.kubernetes.io/name: clair
    app.kubernetes.io/instance: quay-registry
    app.kubernetes.io/component: security-scanner
    quay-operator/quayregistry: quay-registry
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: quay-registry-clair
  minReplicas: 2
  maxReplicas: 2
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 90
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 90