apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
  name: aqua-operator.v0.0.2
  namespace: placeholder
  annotations:
    capabilities: Basic Install
    categories: Security
    description: The Aqua Security Operator runs within a Openshift cluster and provides a means to deploy and manage Aqua Security cluster and components.
    certified: "false"
    containerImage: aquasec/aqua-operator:0.0.2
    createdAt: 2019-03-21T08:00:00Z
    support: Aqua Security, Inc.
    repository: https://github.com/aquasecurity/aqua-operator
    alm-examples: |-
      [
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaCsp",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": true,
            "password": "password",
            "rbac": {
              "enable": true,
              "openshift": true,
              "privileged": true
            },
            "registry": {
              "url": "registry.aquasec.com",
              "username": "example@gmail.com",
              "password": "",
              "email": "example@gmail.com"
            },
            "database": {
              "replicas": 1,
              "service": "ClusterIP",
              "image": {
                "repository": "database",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullPolicy": "IfNotPresent"
              }
            },
            "gateway": {
              "replicas": 1,
              "service": "ClusterIP",
              "image": {
                "repository": "gateway",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullPolicy": "IfNotPresent"
              }
            },
            "server": {
              "replicas": 1,
              "service": "LoadBalancer",
              "image": {
                "repository": "console",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullPolicy": "IfNotPresent"
              }
            },
            "scanner": {
              "deploy": {
                "replicas": 1,
                "service": "ClusterIP",
                "image": {
                  "repository": "scanner",
                  "registry": "registry.aquasec.com",
                  "tag": "4.0",
                  "pullPolicy": "IfNotPresent"
                }
              },
              "min": 1,
              "max": 5,
              "imagesPerScanner": 100
            },
            "adminPassword": "Password1",
            "licenseToken": null,
            "clustermode": false,
            "ssl": false,
            "auditSsl": false
          }
        },
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaDatabase",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": true,
            "password": "password",
            "registry": {
              "url": "registry.aquasec.com",
              "username": "example@gmail.com",
              "password": "",
              "email": "example@gmail.com"
            },
            "deploy": {
              "replicas": 1,
              "service": "ClusterIP",
              "image": {
                "repository": "database",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullpolicy": "IfNotPresent"
              }
            }
          }
        },
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaEnforcer",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": false,
            "serviceAccount": "aqua-sa",
            "token": "tests",
            "rbac": {
              "enable": false,
              "openshift": true,
              "privileged": true
            },
            "deploy": {
              "image": {
                "repository": "enforcer",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullPolicy": "IfNotPresent"
              }
            },
            "gateway": {
              "host": "aqua-gateway-svc",
              "port": 3622
            },
            "sendingHostImages": false,
            "runcInterception": false
          }
        },
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaGateway",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": false,
            "serviceAccount": "aqua-sa",
            "dbSecretName": "aqua-database-password",
            "dbSecretKey": "db-password",
            "deploy": {
              "replicas": 1,
              "service": "ClusterIP",
              "image": {
                "repository": "gateway",
                "registry": "registry.aquasec.com",
                "tag": "3.5",
                "pullpolicy": "IfNotPresent"
              }
            },
            "aquaDb": "aqua-database",
            "ssl": false,
            "auditSsl": false,
            "openshift": true
          }
        },
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaScanner",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": false,
            "serviceAccount": "aqua-sa",
            "deploy": {
              "replicas": 1,
              "service": "ClusterIP",
              "image": {
                "repository": "scanner",
                "registry": "registry.aquasec.com",
                "tag": "4.0",
                "pullPolicy": "IfNotPresent"
              }
            },
            "login": {
              "username": "administrator",
              "password": "Password1",
              "host": "http://aqua-server-svc:8080"
            },
            "openshift": true
          }
        },
        {
          "apiVersion": "operator.aquasec.com/v1alpha1",
          "kind": "AquaServer",
          "metadata": {
            "name": "aqua"
          },
          "spec": {
            "requirements": false,
            "add": false,
            "serviceAccount": "aqua-sa",
            "dbSecretName": "aqua-database-password",
            "dbSecretKey": "db-password",
            "rbac": {
              "enable": true,
              "openshift": true,
              "privileged": true
            },
            "deploy": {
              "replicas": 1,
              "service": "LoadBalancer",
              "image": {
                "repository": "console",
                "registry": "registry.aquasec.com",
                "tag": "3.5",
                "pullPolicy": "IfNotPresent"
              }
            },
            "aquaDb": "aqua-database",
            "adminPassword": "Password1",
            "licenseToken": null,
            "clusterMode": true,
            "ssl": false,
            "auditSsl": false,
            "dockerless": false,
            "openshift": true
          }
        }
      ]
spec:
  displayName: Aqua Security Operator
  version: 0.0.2
  replaces: aqua-operator.v0.0.1
  description: |-
    The Aqua Security Operator runs within an OpenShift cluster, and provides a means to deploy and manage the Aqua Security cluster and components
    * Server (sometimes called “console”)
    * Database (not recommended for production environments)
    * Gateway
    * Enforcer (sometimes called “agent”)
    * Scanner
    * CSP (package containing the Server, Database, and Gateway - not supported, and not for production environments)
    Use the aqua-operator to 
    * Deploy Aqua Security components on OpenShift
    * Scale up Aqua Security components with extra replicas
    * Assign metadata tags to Aqua Security components
    * Automatically scale the number of Aqua scanners according to the number of images in the scan queue
    ## Before You Begin Using the Operator CRDs
    Obtain access to the Aqua registry - https://www.aquasec.com/about-us/contact-us/
    You need to create
    * A secret for the Docker registry
    * A secret for the database
    ```bash
    oc create secret docker-registry aqua-registry --docker-server=registry.aquasec.com --docker-username=<AQUA_USERNAME> --docker-password=<AQUA_PASSWORD> --docker-email=<user email> -n aqua
    oc create secret generic aqua-database-password --from-literal=db-password=<password> -n aqua
    oc secrets add aqua-sa aqua-registry --for=pull -n aqua
    ```
    ## After the Installation
    Once the operator is installed in the cluster, you now can use the CRDs to install the Aqua cluster and components.
  keywords: ['aqua-security', 'scanning', 'security', 'runtime-security']
  maintainers:
  - email: nissim.bitan@aquasec.com
    name: Nissim Bitan, Aqua Security
  provider: 
    name: Aqua Security, Inc.
  maturity: alpha
  labels:
    name: aqua-operator
  selector:
    matchLabels:
      name: aqua-operator
  links:
  - name: Aqua Security
    url: https://www.aquasec.com/
  - name: Prometheus Operator
    url: https://github.com/aquasecurity/aqua-operator
  icon:
  - base64data: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIzLjAuMiwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxheWVyXzEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IgoJIHZpZXdCb3g9IjAgMCAxMDAgMTAwIiBzdHlsZT0iZW5hYmxlLWJhY2tncm91bmQ6bmV3IDAgMCAxMDAgMTAwOyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6I0YwREUzNDt9Cgkuc3Qxe2ZpbGw6I0Y5QUU0MTt9Cgkuc3Qye2ZpbGw6Izk5RDVFQjt9Cgkuc3Qze2ZpbGw6IzAyQjBENDt9Cgkuc3Q0e2ZpbGw6I0Y1OTMyMDt9Cgkuc3Q1e2ZpbGw6IzA5ODA5QTt9Cjwvc3R5bGU+CjxnPgoJPHBvbHlnb24gY2xhc3M9InN0MCIgcG9pbnRzPSI1MCwyLjEgMjUuNSwyNi4xIDc0LjUsMjYuMSA3NC41LDIuMSAJIi8+Cgk8cG9seWdvbiBjbGFzcz0ic3QxIiBwb2ludHM9Ijc0LjUsNzMuOSA5OSw1MCA5OSwyNi4xIDc0LjUsMjYuMSAJIi8+Cgk8cG9seWdvbiBjbGFzcz0ic3QyIiBwb2ludHM9IjI1LjUsNzMuOSAyNS41LDk3LjkgNTAsOTcuOSA3NC41LDczLjkgCSIvPgoJPHBvbHlnb24gY2xhc3M9InN0MyIgcG9pbnRzPSIxLDUwIDEsNzMuOSAyNS41LDczLjkgMjUuNSwyNi4xIAkiLz4KCTxyZWN0IHg9Ijc0LjUiIHk9IjIuMSIgY2xhc3M9InN0NCIgd2lkdGg9IjI0LjUiIGhlaWdodD0iMjMuOSIvPgoJPHJlY3QgeD0iMSIgeT0iNzMuOSIgY2xhc3M9InN0NSIgd2lkdGg9IjI0LjUiIGhlaWdodD0iMjMuOSIvPgo8L2c+Cjwvc3ZnPgo=
    mediatype: image/svg+xml
  miniKubeVersion: 1.11.0
  installModes:
  - supported: true
    type: OwnNamespace
  - supported: true
    type: SingleNamespace
  - supported: false
    type: MultiNamespace
  - supported: false
    type: AllNamespaces
  install:
    strategy: deployment
    spec:
      clusterPermissions:
      - serviceAccountName: aqua-sa
        rules:
        - apiGroups:
          - "security.openshift.io"
          resources:
          - securitycontextconstraints
          verbs:
          - use
          resourceNames:
          - privileged
          - host
      - serviceAccountName: aqua-operator
        rules:
        - apiGroups:
          - ""
          resources:
          - pods
          - services
          - endpoints
          - persistentvolumeclaims
          - events
          - configmaps
          - secrets
          - serviceaccounts
          - nodes
          verbs:
          - '*'
        - apiGroups:
          - ""
          resources:
          - namespaces
          verbs:
          - get
        - apiGroups:
          - apps
          - extensions
          resources:
          - '*'
          - deployments
          - daemonsets
          - replicasets
          - statefulsets
          - podsecuritypolicies
          verbs:
          - '*'
        - apiGroups:
          - monitoring.coreos.com
          resources:
          - servicemonitors
          verbs:
          - get
          - create
        - apiGroups:
          - operator.aquasec.com
          resources:
          - '*'
          - aquagateways
          - aquaservers
          - aquacsps
          - aquaenforcers
          - aquascanners
          verbs:
          - '*'
        - apiGroups:
          - rbac.authorization.k8s.io
          - authorization.k8s.io
          resources:
          - '*'
          - clusterroles
          - clusterrolebindings
          verbs:
          - '*'
        - apiGroups:
          - policy
          resources:
          - '*'
          - podsecuritypolicies
          verbs:
          - '*'
      deployments:
      - name: aqua-operator
        spec:
          replicas: 1
          selector:
            matchLabels:
              name: aqua-operator 
          template:
            metadata:
              labels:
                name: aqua-operator
            spec:
              serviceAccountName: aqua-operator
              containers:
              - name: aqua-operator
                image: aquasec/aqua-operator:0.0.2
                imagePullPolicy: Always
                command:
                - aqua-operator
                env:
                - name: WATCH_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.annotations['olm.targetNamespaces']
                - name: POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: OPERATOR_NAME
                  value: "aqua-operator"
                ports:
                - containerPort: 60000
                  name: metrics
                readinessProbe:
                  exec:
                    command:
                    - stat
                    - /tmp/operator-sdk-ready
                  failureThreshold: 1
                  initialDelaySeconds: 4
                  periodSeconds: 10
  customresourcedefinitions:
    owned:
    - kind: AquaCsp
      name: aquacsps.operator.aquasec.com
      version: v1alpha1
      displayName: AquaCsp
      description: Aqua Security CSP Deployment with Aqua Operator
    - kind: AquaDatabase
      name: aquadatabases.operator.aquasec.com
      version: v1alpha1
      displayName: AquaDatabase
      description: Aqua Security Database Deployment with Aqua Operator
    - kind: AquaEnforcer
      name: aquaenforcers.operator.aquasec.com
      version: v1alpha1
      displayName: AquaEnforcer
      description: Aqua Security Enforcer Deployment with Aqua Operator
    - kind: AquaGateway
      name: aquagateways.operator.aquasec.com
      version: v1alpha1
      displayName: AquaGateway
      description: Aqua Security Gateway Deployment with Aqua Operator
    - kind: AquaScanner
      name: aquascanners.operator.aquasec.com
      version: v1alpha1
      displayName: AquaScanner
      description: Aqua Security Scanner Deployment with Aqua Operator
    - kind: AquaServer
      name: aquaservers.operator.aquasec.com
      version: v1alpha1
      displayName: AquaServer
      description: Aqua Security Server Deployment with Aqua Operator
