05-starboard-operator.deployment.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: starboard-operator
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.4"
    app.kubernetes.io/managed-by: kubectl
  annotations:
    prometheus.io/path: /metrics
    prometheus.io/scrape: "true"
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: metrics
      name: metrics
  selector:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: starboard-operator
  namespace: starboard-system
  labels:
    app.kubernetes.io/name: starboard-operator
    app.kubernetes.io/instance: starboard-operator
    app.kubernetes.io/version: "0.15.4"
    app.kubernetes.io/managed-by: kubectl
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: starboard-operator
      app.kubernetes.io/instance: starboard-operator
  template:
    metadata:
      labels:
        app.kubernetes.io/name: starboard-operator
        app.kubernetes.io/instance: starboard-operator
    spec:
      serviceAccountName: starboard-operator
      automountServiceAccountToken: true
      containers:
        - name: "starboard-operator"
          image: "docker.io/aquasec/starboard-operator:0.15.4"
          imagePullPolicy: IfNotPresent
          env:
            - name: OPERATOR_NAMESPACE
              value: "starboard-system"
            - name: OPERATOR_TARGET_NAMESPACES
              value: ""
            - name: OPERATOR_EXCLUDE_NAMESPACES
              value: "kube-system,starboard-system"
            - name: OPERATOR_SERVICE_ACCOUNT
              value: "starboard-operator"
            - name: OPERATOR_LOG_DEV_MODE
              value: "false"
            - name: OPERATOR_SCAN_JOB_TIMEOUT
              value: "5m"
            - name: OPERATOR_CONCURRENT_SCAN_JOBS_LIMIT
              value: "10"
            - name: OPERATOR_SCAN_JOB_RETRY_AFTER
              value: "30s"
            - name: OPERATOR_BATCH_DELETE_LIMIT
              value: "10"
            - name: OPERATOR_BATCH_DELETE_DELAY
              value: "10s"
            - name: OPERATOR_METRICS_BIND_ADDRESS
              value: ":8080"
            - name: OPERATOR_HEALTH_PROBE_BIND_ADDRESS
              value: ":9090"
            - name: OPERATOR_CIS_KUBERNETES_BENCHMARK_ENABLED
              value: "true"
            - name: OPERATOR_VULNERABILITY_SCANNER_ENABLED
              value: "true"
            - name: OPERATOR_VULNERABILITY_SCANNER_SCAN_ONLY_CURRENT_REVISIONS
              value: "false"
            - name: OPERATOR_VULNERABILITY_SCANNER_REPORT_TTL
              value: ""
            - name: OPERATOR_CONFIG_AUDIT_SCANNER_ENABLED
              value: "false"
            - name: OPERATOR_CONFIG_AUDIT_SCANNER_BUILTIN
              value: "true"
            - name: OPERATOR_CLUSTER_COMPLIANCE_ENABLED
              value: "true"
          ports:
            - name: metrics
              containerPort: 8080
            - name: probes
              containerPort: 9090
          readinessProbe:
            httpGet:
              path: /readyz/
              port: probes
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz/
              port: probes
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 10
          resources:
            {}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: true
      securityContext:
        {}