apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: sslsniffer-daemon
  labels:
    app: sslsniffer
spec:
  selector:
    matchLabels:
      app: sslsniffer
  template:
    metadata:
      labels:
        app: sslsniffer
    spec:
      hostPID: true
      serviceAccountName: sslsniffer-sa # Refer to https://sample-config.appsentinels.ai/appsentinels-deployment/sslsniffer/k8/role.yaml
      # Affinity to ensure the sniffer pod is scheduled on the same node as the ingress controller pods
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name # Key for AKS
                    operator: In
                    values:
                      - <nginx ingress label>  # 👈 This is the label of the ingress controller pod, change if accordingly
                                               # Get it from, kubectl get pods -n ingress -l app.kubernetes.io/name=ingress-nginx --show-labels
              namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: <ingress namespace> # this is the namespace of the ingress controller change, if other then "ingress"
              topologyKey: "kubernetes.io/hostname"    		   # pod scheduled on the same node as the matching pod
      containers:
        - name: sniffer
          image: appsentinels/sslsniffer:latest
          securityContext:
            privileged: true
            capabilities:
              add:
                - SYS_ADMIN
                - SYS_PTRACE
          env:
            - name: REMOTE_CONTROLLER_SERVER_ENDPOINT
              value: "http://<onprem-controller-ip/hostname>:9004/mergedlog"
            - name: INSTANCE_NAME
              value: "<instance-name>"
            - name: SSLSNIFF_CONTAINER_INCLUDE_FILTER
              value: "nginx-ingress"            
          volumeMounts:
            - name: containerd-socket
              mountPath: /var/run/containerd/containerd.sock
            - name: sys-fs
              mountPath: /sys
              readOnly: true
      volumes:
        - name: containerd-socket
          hostPath:
            path: /var/run/containerd/containerd.sock
            type: Socket
        - name: sys-fs
          hostPath:
            path: /sys
            type: Directory
