---
# Source: node-scanner-service/templates/rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: node-scanner-sa
---
# Source: node-scanner-service/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-scanner-cluster-role
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["list"]
- apiGroups: [""]
  resources: ["namespaces"]
  resourceNames: ["kube-system"]
  verbs: ["get"]
---
# Source: node-scanner-service/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: node-scanner-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: node-scanner-cluster-role
subjects:
- kind: ServiceAccount
  name: node-scanner-sa
  namespace: namespace_placeholder
---
# Source: node-scanner-service/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: node-scanner-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "create", "update", "patch"]
---
# Source: node-scanner-service/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: node-scanner-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: node-scanner-role
subjects:
- kind: ServiceAccount
  name: node-scanner-sa
  namespace: namespace_placeholder
---
# Source: node-scanner-service/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: node-scanner-service-service
spec:
  type: ClusterIP
  ports:
  - port: 8088
    targetPort: 8080
    name: http
  clusterIP: None  # Headless service for individual pod access
  selector:
    app.kubernetes.io/app-name: node-scanner-service
---
# Source: node-scanner-service/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-scanner-ds
  labels:
    app.kubernetes.io/app-name: node-scanner-service
spec:
  selector:
    matchLabels:
      app.kubernetes.io/app-name: node-scanner-service
  template:
    metadata:
      labels:
        app.kubernetes.io/app-name: node-scanner-service
        app: node-scanner
    spec:
      imagePullSecrets:
        - name: regcred
      serviceAccountName: node-scanner-sa
      containers:
      - name: scanner
        image: cubbit/node-scanner-service:latest
        imagePullPolicy: Always
        securityContext:
          privileged: true  # Required to access host filesystem
          runAsUser: 0      # Run as root to access host paths
        volumeMounts:
        - name: host-path
          mountPath: scanpath_placeholder
          readOnly: true  # For safety
        ports:
        - containerPort: 8080
          name: http
        env:
        - name: LOG_LEVEL
          value: "info"
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        envFrom:
        - configMapRef:
            name: node-scanner-service-config
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
      volumes:
      - name: host-path
        hostPath:
          path: scanpath_placeholder
          type: Directory
---
