apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ include "harbor-scanner-trivy.fullname" . }}
  labels:
{{ include "harbor-scanner-trivy.labels" . | indent 4 }}
spec:
  serviceName: {{ include "harbor-scanner-trivy.fullname" . }}
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "harbor-scanner-trivy.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  {{- if .Values.persistence.enabled }}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        resources:
          requests:
            storage: {{ .Values.persistence.size }}
        accessModes:
          - {{ .Values.persistence.accessMode }}
        storageClassName: {{ .Values.persistence.storageClass }}
  {{- end }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "harbor-scanner-trivy.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
    spec:
      {{- if .Values.podSecurityContext }}
      automountServiceAccountToken: false
      securityContext:
{{ toYaml .Values.podSecurityContext | indent 8 }}
      {{- end }}
      containers:
        - name: main
          image: {{ template "harbor-scanner-trivy.imageRef" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
          {{- if .Values.securityContext }}
          securityContext:
{{ toYaml .Values.securityContext | indent 12 }}
          {{- end }}
          env:
            - name: "SCANNER_LOG_LEVEL"
              value: {{ .Values.scanner.logLevel | default "info" | quote }}
            - name: "SCANNER_API_SERVER_ADDR"
              value: ":{{ .Values.service.port | default 8080 }}"
            - name: "SCANNER_API_SERVER_READ_TIMEOUT"
              value: {{ .Values.scanner.api.readTimeout | default "15s" | quote }}
            - name: "SCANNER_API_SERVER_WRITE_TIMEOUT"
              value: {{ .Values.scanner.api.writeTimeout | default "15s" | quote }}
            - name: "SCANNER_API_SERVER_IDLE_TIMEOUT"
              value: {{ .Values.scanner.api.idleTimeout | default "60s" | quote }}
            - name: "SCANNER_TRIVY_CACHE_DIR"
              value: {{ .Values.scanner.trivy.cacheDir | quote }}
            - name: "SCANNER_TRIVY_REPORTS_DIR"
              value: {{ .Values.scanner.trivy.reportsDir | quote }}
            - name: "SCANNER_TRIVY_DEBUG_MODE"
              value: {{ .Values.scanner.trivy.debugMode | default false | quote }}
            - name: "SCANNER_TRIVY_VULN_TYPE"
              value: {{ .Values.scanner.trivy.vulnType | default "os,library" | quote }}
          {{- if (.Values.scanner.trivy.ignorePolicy) }}
            - name: "SCANNER_TRIVY_IGNORE_POLICY"
              value: "/home/scanner/opa/policy.rego"
          {{- end }}
            - name: "SCANNER_TRIVY_SEVERITY"
              value: {{ .Values.scanner.trivy.severity | default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" | quote }}
            - name: "SCANNER_TRIVY_IGNORE_UNFIXED"
              value: {{ .Values.scanner.trivy.ignoreUnfixed | default false | quote }}
            - name: "SCANNER_TRIVY_TIMEOUT"
              value: {{ .Values.scanner.trivy.timeout | quote }}
            - name: "SCANNER_TRIVY_SKIP_UPDATE"
              value: {{ .Values.scanner.trivy.skipUpdate | quote }}
            - name: "SCANNER_TRIVY_SKIP_JAVA_DB_UPDATE"
              value: {{ .Values.scanner.trivy.skipJavaDBUpdate | quote }}
            - name: "SCANNER_TRIVY_OFFLINE_SCAN"
              value: {{ .Values.scanner.trivy.offlineScan | quote }}
            - name: "SCANNER_TRIVY_DB_REPOSITORY"
              value: {{ .Values.scanner.trivy.dbRepository | quote }}
            - name: "SCANNER_TRIVY_JAVA_DB_REPOSITORY"
              value: {{ .Values.scanner.trivy.javaDBRepository | quote }}
            - name: "SCANNER_TRIVY_GITHUB_TOKEN"
              valueFrom:
                secretKeyRef:
                  name: {{ include "harbor-scanner-trivy.fullname" . }}
                  key: gitHubToken
            - name: "SCANNER_TRIVY_INSECURE"
              value: {{ .Values.scanner.trivy.insecure | default false | quote }}
            - name: "SCANNER_STORE_REDIS_NAMESPACE"
              value: {{ .Values.scanner.store.redisNamespace | default "harbor.scanner.trivy:store" | quote }}
            - name: "SCANNER_STORE_REDIS_SCAN_JOB_TTL"
              value: {{ .Values.scanner.store.redisScanJobTTL | default "1h" | quote }}
            - name: "SCANNER_JOB_QUEUE_REDIS_NAMESPACE"
              value: {{ .Values.scanner.jobQueue.redisNamespace | default "harbor.scanner.trivy:job-queue" | quote }}
            - name: "SCANNER_JOB_QUEUE_WORKER_CONCURRENCY"
              value: {{ .Values.scanner.jobQueue.workerConcurrency | default 1 | quote }}
            - name: "SCANNER_REDIS_URL"
              value: {{ .Values.scanner.redis.poolURL | default "redis://harbor-harbor-redis:6379" | quote }}
            - name: "SCANNER_REDIS_POOL_MAX_ACTIVE"
              value: {{ .Values.scanner.redis.poolMaxActive | default 5 | quote }}
            - name: "SCANNER_REDIS_POOL_MAX_IDLE"
              value: {{ .Values.scanner.redis.poolMaxIdle | default 5 | quote }}
            - name: "SCANNER_REDIS_POOL_IDLE_TIMEOUT"
              value: {{ .Values.scanner.redis.poolIdleTimeout | default "5m" | quote }}
            - name: SCANNER_REDIS_POOL_CONNECTION_TIMEOUT
              value: {{ .Values.scanner.redis.poolConnectionTimeout | default "1s" | quote }}
            - name: SCANNER_REDIS_POOL_READ_TIMEOUT
              value: {{ .Values.scanner.redis.poolReadTimeout | default "1s" | quote }}
            - name: SCANNER_REDIS_POOL_WRITE_TIMEOUT
              value: {{ .Values.scanner.redis.poolWriteTimeout | default "1s" | quote }}
            - name: "HTTP_PROXY"
              value: {{ .Values.httpProxy | quote }}
            - name: "HTTPS_PROXY"
              value: {{ .Values.httpsProxy | quote }}
            - name: "NO_PROXY"
              value: {{ .Values.noProxy | quote }}
            {{- if .Values.scanner.api.tlsEnabled }}
            - name: "SCANNER_API_SERVER_TLS_CERTIFICATE"
              value: "/certs/tls.crt"
            - name: "SCANNER_API_SERVER_TLS_KEY"
              value: "/certs/tls.key"
            - name: "SCANNER_TRIVY_VEX_SOURCE"
              value: {{ .Values.scanner.trivy.VEXSource | default "" | quote }}
            - name: "SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE"
              value: {{ .Values.scanner.trivy.skipVEXRepoUpdate | default false | quote }}
            {{- end }}
          ports:
            - name: api-server
              containerPort: {{ .Values.service.port }}
          livenessProbe:
            httpGet:
              scheme: {{ if .Values.scanner.api.tlsEnabled }}HTTPS{{ else }}HTTP{{ end }}
              path: /probe/healthy
              port: api-server
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 10
          readinessProbe:
            httpGet:
              scheme: {{ if .Values.scanner.api.tlsEnabled }}HTTPS{{ else }}HTTP{{ end }}
              path: /probe/ready
              port: api-server
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          volumeMounts:
            - mountPath: /tmp
              name: tmp-data
              readOnly: false
            - mountPath: /home/scanner/.cache
              name: data
              readOnly: false
            {{- if .Values.scanner.api.tlsEnabled }}
            - mountPath: /certs
              name: certs
              readOnly: true
            {{- end }}
            {{- if (.Values.scanner.trivy.ignorePolicy) }}
            - name: trivy-ignorepolicy
              mountPath: /home/scanner/opa/
            {{- end }}
          {{- if .Values.resources }}
          resources:
{{ toYaml .Values.resources | indent 12 }}
          {{- end }}
      volumes:
        - name: tmp-data
          emptyDir: {}
        {{- if not .Values.persistence.enabled }}
        - name: data
          emptyDir: {}
        {{- end }}
        {{- if .Values.scanner.api.tlsEnabled }}
        - name: certs
          secret:
            secretName: {{ include "harbor-scanner-trivy.fullname" . }}-tls
        {{- end }}
        {{- if (.Values.scanner.trivy.ignorePolicy) }}
        - name: trivy-ignorepolicy
          configMap:
            name: {{ include "harbor-scanner-trivy.fullname" . }}-ignorepolicy
        {{- end }}
