# 1. This file is an example of k8 multi-container pod where Appsentinels controller is running
# along with nginx ingress controller
# 2. The ingress controller container properties defined are for samples only. It might be different for your
# deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-ingress
  namespace: nginx-ingress
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-ingress
  template:
    metadata:
      labels:
        app: nginx-ingress
    spec:
      serviceAccountName: nginx-ingress
      containers:
        # #####################################################
        # Start of properties of appsentinels sniffer sidecar container
       - image: appsentinels/ng-controller:latest
         imagePullPolicy: Always
         name: appsentinels-controller
         env:
         - name: APPLICATION_INFO
           value: <your application>
         - name: ENVIRONMENT
           value: <your environment>
         - name: SNIFFER_SENSOR_INSTANCE
           value: <sniffer sensor instance, eg: service-1>
         - name: REMOTE_CONTROLLER_SERVER_NAME
           value: <dns mapped hostname or IP of controller, eg: remote-controller>
         - name: REMOTE_CONTROLLER_SERVER_PORT
          value: "9004"
         - name: TAP_INTERFACE
           value: <interface to sniff on, usually lo for sniffer in pod>
         - name: TAP_FILTER
            value: <bpf filter with hyphens for spaces, eg: port-8090-or-3000-and-tcp>
         - name: RELAY_PROTOCOL
           value: http
         resources:
           requests:
             cpu: 0.5
             memory: 512Mi
           limits:
             cpu: 0.5
             memory: 512Mi 
       # end of properties of appsentinels sniffer sidecar container
       # #####################################################
      - image: nginx/nginx-ingress:2.1.0
        imagePullPolicy: IfNotPresent
        name: nginx-ingress
        ports:
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443
        - name: readiness-port
          containerPort: 8081
        readinessProbe:
          httpGet:
            path: /nginx-ready
            port: readiness-port
          periodSeconds: 1
        securityContext:
          allowPrivilegeEscalation: true
          runAsUser: 101 #nginx
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        args:
          - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
          - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
