apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-service-ca
  namespace: perftestx-clair
  annotations:
    service.beta.openshift.io/inject-cabundle: 'true'
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: indexer-claim
  namespace: perftestx-clair
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
  storageClassName: gp2
  volumeMode: Filesystem
---
apiVersion: v1
kind: Service
metadata:
  name: clair-app-indexer-service
  namespace: perftestx-clair
  labels:
    clair-component: clair-app
spec:
  ports:
    - name: clair-http
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: clair-introspection
      port: 8089
      protocol: TCP
      targetPort: 8089
  selector:
    clair-component: clair-app-indexer
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: clair-app-matcher-service
  namespace: perftestx-clair
  labels:
    clair-component: clair-app
spec:
  ports:
    - name: clair-http
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: clair-introspection
      port: 8089
      protocol: TCP
      targetPort: 8089
  selector:
    clair-component: clair-app-matcher
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: clair-app-notifier-service
  namespace: perftestx-clair
  labels:
    clair-component: clair-app
spec:
  ports:
    - name: clair-http
      port: 80
      protocol: TCP
      targetPort: 8080
    - name: clair-introspection
      port: 8089
      protocol: TCP
      targetPort: 8089
  selector:
    clair-component: clair-app-notifier
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    clair-component: clair-app-indexer
  name: clair-app-indexer
  namespace: perftestx-clair
spec:
  replicas: 1
  selector:
    matchLabels:
      clair-component: clair-app-indexer
  template:
    metadata:
      labels:
        clair-component: clair-app-indexer
    spec:
      serviceAccountName: clair-app
      containers:
        - image: quay.io/crozzy/clair:dev-crozzy
          imagePullPolicy: Always
          name: clair-app-indexer
          resources:
            limits:
              cpu: "6000m"
          env:
            - name: CLAIR_CONF
              value: /clair/config.yaml
            - name: CLAIR_MODE
              value: indexer
          ports:
            - containerPort: 8080
              name: clair-http
              protocol: TCP
            - containerPort: 8089
              name: clair-intro
              protocol: TCP
          volumeMounts:
            - mountPath: /clair/
              name: config
            - mountPath: /tmp
              name: indexer-layer-storage
          startupProbe:
            tcpSocket:
              port: clair-intro
            periodSeconds: 10
            failureThreshold: 300
          readinessProbe:
            tcpSocket:
              port: 8080
          livenessProbe:
            httpGet:
              port: clair-intro
              path: /healthz
      restartPolicy: Always
      volumes:
        - name: config
          secret:
            secretName: clair-config-secret
        - name: indexer-layer-storage
          persistentVolumeClaim:
            claimName: indexer-claim
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    clair-component: clair-app-matcher
  name: clair-app-matcher
  namespace: perftestx-clair
spec:
  replicas: 1
  selector:
    matchLabels:
      clair-component: clair-app-matcher
  template:
    metadata:
      labels:
        clair-component: clair-app-matcher
    spec:
      serviceAccountName: clair-app
      containers:
        - image: quay.io/crozzy/clair:dev-crozzy
          imagePullPolicy: Always
          name: clair-app-matcher
          env:
            - name: CLAIR_CONF
              value: /clair/config.yaml
            - name: CLAIR_MODE
              value: matcher
          ports:
            - containerPort: 8080
              name: clair-http
              protocol: TCP
            - containerPort: 8089
              name: clair-intro
              protocol: TCP
          volumeMounts:
            - mountPath: /clair/
              name: config
#            - mountPath: /var/run/certs
#              name: certs
          startupProbe:
            tcpSocket:
              port: clair-intro
            periodSeconds: 10
            failureThreshold: 300
          readinessProbe:
            tcpSocket:
              port: 8080
          livenessProbe:
            httpGet:
              port: clair-intro
              path: /healthz
      restartPolicy: Always
      volumes:
        - name: config
          secret:
            secretName: clair-config-secret
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    clair-component: clair-app-notifier
  name: clair-app-notifier
  namespace: perftestx-clair
spec:
  replicas: 1
  selector:
    matchLabels:
      clair-component: clair-app-notifier
  template:
    metadata:
      labels:
        clair-component: clair-app-notifier
    spec:
      serviceAccountName: clair-app
      containers:
        - image: quay.io/crozzy/clair:dev-crozzy
          imagePullPolicy: Always
          name: clair-app-notifier
          env:
            - name: CLAIR_CONF
              value: /clair/config.yaml
            - name: CLAIR_MODE
              value: notifier
          ports:
            - containerPort: 8080
              name: clair-http
              protocol: TCP
            - containerPort: 8089
              name: clair-intro
              protocol: TCP
          volumeMounts:
            - mountPath: /clair/
              name: config
#            - mountPath: /var/run/certs
#              name: certs
          startupProbe:
            tcpSocket:
              port: clair-intro
            periodSeconds: 10
            failureThreshold: 300
          readinessProbe:
            tcpSocket:
              port: 8080
          livenessProbe:
            httpGet:
              port: clair-intro
              path: /healthz
      restartPolicy: Always
      volumes:
        - name: config
          secret:
            secretName: clair-config-secret
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: clair-app
  namespace: perftestx-clair
---
apiVersion: v1
kind: Secret
metadata:
  name: clair-config-secret
  namespace: perftestx-clair
stringData:
  config.yaml: |
    http_listen_addr: :8080
    introspection_addr: ""
    log_level: info
    indexer:
        connstring: host=perftest1-clair-dist-db.crukvbvrik6e.us-west-1.rds.amazonaws.com port=5432 dbname=clair user=clair password=clairdistpass sslmode=disable
        scanlock_retry: 10
        layer_scan_concurrency: 10
        migrations: true
        scanner:
            package: {}
            dist: {}
            repo: {}
        airgap: false
    matcher:
        connstring: host=perftest1-clair-dist-db.crukvbvrik6e.us-west-1.rds.amazonaws.com port=5432 dbname=clair user=clair password=clairdistpass sslmode=disable
        max_conn_pool: 100
        indexer_addr: "http://clair-app-indexer-service"
        migrations: true
        period: null
        disable_updaters: false  
    notifier:
      connstring: host=perftest1-clair-dist-db.crukvbvrik6e.us-west-1.rds.amazonaws.com port=5432 dbname=clair user=clair password=clairdistpass sslmode=disable
      migrations: true
      indexer_addr: "http://clair-app-indexer-service"
      matcher_addr: "http://clair-app-matcher-service"
      poll_interval: 5m
      delivery_interval: 1m
      amqp: null
      stomp: null
    auth:
        psk:
            key: <redacted>
            iss:
                - quay
                - clairctl
    metrics:
        name: prometheus
        prometheus:
            endpoint: null
        dogstatsd:
            url: ""
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: clair-indexer
  namespace: perftestx-clair
  labels:
    clair-component: clair-app-indexer
  annotations:
    openshift.io/host.generated: 'true'
    haproxy.router.openshift.io/timeout: '2h'
spec:
  host: clair-indexer-perftestx-clair.apps.quaydev-rosa-1.czz9.p1.openshiftapps.com
  path: /indexer
  to:
    kind: Service
    name: clair-app-indexer-service
    weight: 100
  port:
    targetPort: clair-http
  wildcardPolicy: None
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: clair-matcher
  namespace: perftestx-clair
  labels:
    clair-component: clair-app-matcher
  annotations:
    openshift.io/host.generated: 'true'
spec:
  host: clair-indexer-perftestx-clair.apps.quaydev-rosa-1.czz9.p1.openshiftapps.com
  path: /matcher
  to:
    kind: Service
    name: clair-app-matcher-service
    weight: 100
  port:
    targetPort: clair-http
  wildcardPolicy: None
