---
# ------------------- Kubescape Service Account ------------------- #
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: kubescape
  name: kubescape-discovery
  namespace: kubescape

---
# ------------------- Kubescape Role & Role Binding ------------------- #
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-discovery-role
  namespace: kubescape
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "describe"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubescape-discovery-binding
  namespace: kubescape
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubescape-discovery-role
subjects:
- kind: ServiceAccount
  name: kubescape-discovery

---
# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- #
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-discovery-clusterroles
  # "namespace" omitted since ClusterRoles are not namespaced
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "describe"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubescape-discovery-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubescape-discovery-clusterroles
subjects:
- kind: ServiceAccount
  name: kubescape-discovery
  namespace: kubescape

---
# ------------------- Kubescape User/Customer GUID ------------------- #
kind: ConfigMap 
apiVersion: v1 
metadata:
  name: kubescape-configmap 
  labels:
    app: kubescape
  namespace: kubescape
data:
  config.json: |
    {
      "adminMail": "",
      "customerGUID": "<MyGUID>",
      "clusterName": "<MyK8sClusterName>",
      "invitationParam": ""
    }

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: kubescape
  labels:
    app: kubescape
  namespace: kubescape
spec:
  #      ┌────────────────── timezone (optional)
  #      |      ┌───────────── minute (0 - 59)
  #      |      │ ┌───────────── hour (0 - 23)
  #      |      │ │ ┌───────────── day of the month (1 - 31)
  #      |      │ │ │ ┌───────────── month (1 - 12)
  #      |      │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
  #      |      │ │ │ │ │                         7 is also Sunday on some systems)
  #      |      │ │ │ │ │
  #      |      │ │ │ │ │
  # CRON_TZ=UTC * * * * *
  schedule: "0 0 1 * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: kubescape
            image: quay.io/armosec/kubescape:latset
            imagePullPolicy: IfNotPresent
            command: ["/bin/sh","-c"]
            args: 
            - kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
            #- kubescape scan framework nsa --use-default --exclude-namespaces kube-system,kube-public
            volumeMounts:
            - name: kubescape-config-volume
              mountPath: /root/.kubescape/config.json
              subPath: config.json
          restartPolicy: OnFailure
          serviceAccountName: kubescape-discovery
          volumes:
          - name: kubescape-config-volume
            configMap:
              name: kubescape-configmap

---


