apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
  annotations:
    capabilities: Full Lifecycle
    categories: Security
    containerImage: quay.io/quay/container-security-operator@sha256:6eefeaee910251ba26c825746d11ae166a9781aeace5455b2766d26298911f13
    createdAt: 2020-04-13 00:00:00
    description: Identify image vulnerabilities in Kubernetes pods
    repository: https://github.com/quay/container-security-operator
    tectonic-visibility: ocs
  name: container-security-operator.v1.0.6
  namespace: placeholder
spec:
  customresourcedefinitions:
    owned:
    - description: Represents a set of vulnerabilities in an image manifest.
      displayName: Image Manifest Vulnerability
      kind: ImageManifestVuln
      name: imagemanifestvulns.secscan.quay.redhat.com
      version: v1alpha1
  description: "The Container Security Operator (CSO) brings Quay and Clair metadata to Kubernetes / OpenShift.\
    \ Starting with vulnerability information the scope will get expanded over time. If it runs on OpenShift,\
    \ the corresponding vulnerability information is shown inside the OCP Console. The Container Security Operator\
    \ enables cluster administrators to monitor known container\
    \ image vulnerabilities in pods running on their Kubernetes cluster. The controller sets up a watch\
    \ on pods in the specified namespace(s) and queries the container registry for vulnerability\
    \ information. If the container registry supports image scanning,\
    \ such as [Quay](https://github.com/quay/quay) with [Clair](https://github.com/quay/clair),\
    \ then the Operator will expose any vulnerabilities found via the Kubernetes API in an\
    \ `ImageManifestVuln` object.  This Operator requires no additional configuration after deployment,\
    \ and will begin watching pods and populating `ImageManifestVulns` immediately once installed."
  displayName: Container Security
  install:
    spec:
      deployments:
      - name: container-security-operator
        spec:
          replicas: 1
          selector:
            matchLabels:
              name: container-security-operator-alm-owned
          template:
            metadata:
              labels:
                name: container-security-operator-alm-owned
              name: container-security-operator-alm-owned
            spec:
              containers:
              - command:
                - /bin/security-labeller
                - '--namespaces=$(WATCH_NAMESPACE)'
                - '--extraCerts=/extra-certs'
                env:
                - name: MY_POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: MY_POD_NAME
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.name
                - name: WATCH_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.annotations['olm.targetNamespaces']
                volumeMounts:
                  - name: extra-certs
                    readOnly: true
                    mountPath: /extra-certs
                image: quay.io/projectquay/container-security-operator@sha256:f937d284761118fd0d4a5bb45f295266492c1fb156ae656c8f4f1501a913426a
                name: container-security-operator
              serviceAccountName: container-security-operator
              volumes:
                - name: extra-certs
                  secret:
                    optional: true
                    secretName: container-security-operator-extra-certs
      permissions:
      - rules:
        - apiGroups:
          - secscan.quay.redhat.com
          resources:
          - imagemanifestvulns
          - imagemanifestvulns/status
          verbs:
          - '*'
        - apiGroups:
          - ''
          resources:
          - pods
          - events
          verbs:
          - '*'
        - apiGroups:
          - ''
          resources:
          - secrets
          verbs:
          - get
        serviceAccountName: container-security-operator
    strategy: deployment
  installModes:
  - supported: true
    type: OwnNamespace
  - supported: true
    type: SingleNamespace
  - supported: true
    type: MultiNamespace
  - supported: true
    type: AllNamespaces
  keywords:
  - open source
  - containers
  - security
  labels:
    alm-owner-container-security-operator: container-security-operator
    operated-by: container-security-operator
  icon:
  - base64data: [encoded data, 9472 characters]
    mediatype: image/png
  maturity: alpha
  links:
  - name: Source Code
    url: https://github.com/quay/container-security-operator
  maintainers:
  - email: quay-devel@redhat.com
    name: Quay Engineering Team
  provider:
    name: Red Hat
  selector:
    matchLabels:
      alm-owner-container-security-operator: container-security-operator
      operated-by: container-security-operator
  version: 1.0.6
  replaces: container-security-operator.v1.0.5
