apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: sslsniffer-daemon
  namespace: default
  labels:
    app: sslsniffer
spec:
  selector:
    matchLabels:
      app: sslsniffer
  template:
    metadata:
      labels:
        app: sslsniffer
    spec:
      hostPID: true
      serviceAccountName: sslsniffer-sa
      containers:
        - name: sslsniffer
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30    # Wait before first probe
            periodSeconds: 600          # Once every 60s instead of every 10s
            timeoutSeconds: 5
            failureThreshold: 3

          image: appsentinels/ng-controller:latest
          imagePullPolicy: Always
          securityContext:
            privileged: true
            capabilities:
              add:
                - SYS_ADMIN
                - SYS_PTRACE
                - NET_ADMIN
          env:
            - name: RELAY_PROTOCOL
              value: "http"
            - name: BYPASS
              value: "authzbypass,accesslogbypass"
            - name: ENABLE_EBPF_SENSOR
              value: "true"
            - name: REMOTE_CONTROLLER_SERVER_NAME
              value: "10.101.3.205"
            - name: GOGC
              value: "10"
            - name: SSLSNIFF_EXCLUDE_PROC_FILTER
              value: "(data-path-handler|dp-commands|tail|bash|sh|cat|ls|ps|grep|awk|sed|sleep|nc|netcat|sslsniffer|pause|kube-proxy|coredns|kube-dns|proxy-agent|server-with-metrics|sidecar|otelsvc|istio-proxy|envoy|linkerd-proxy|fluentd|fluent-bit|promtail|filebeat|logstash|datadog-agent|newrelic-infra|collectd|telegraf|metrics-server|aws-vpc-cni|aws-k8s-agent|docker|as-request|agent|containerd)"
            - name: REMOTE_CONTROLLER_SERVER_PORT
              value: "9004"
            - name: LOGGING_LEVEL
              value: "error"
            - name: DOCKER_API_VERSION
              value: "1.44"
            - name: ENABLE_NONSSL_SNIFF_TCP
              value: "True"
            - name: GOMEMLIMIT
              value: "128MiB"
            - name: SKIP_EXTENSIONS
              value: "svg|txt|png|jpg|jpeg|io|tff|woff|woff2|ico|css|pdf|html|mp4|php|ajax|js|gif|tiff|ttf|doc|docx|wasm|aspx"
            - name: SKIP_URI_REGEX
              value: "health|mergedlog|appsentinels|dp-"
            - name: SSLSNIFF_CONTAINER_INCLUDE_FILTER
              value: ".*"
            - name: ENABLE_SSL_SNIFF
              value: "false"
          volumeMounts:
            - name: containerd-socket
              mountPath: /var/run/containerd/containerd.sock
            - name: sys-fs
              mountPath: /sys
              readOnly: true
          resources:
            requests:
              memory: "512Mi"
              cpu: "100m"
            limits:
              memory: "2Gi"
              cpu: "1000m"
      volumes:
        - name: containerd-socket
          hostPath:
            path: /var/run/containerd/containerd.sock
            type: Socket
        - name: sys-fs
          hostPath:
            path: /sys
            type: Directory

