deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: armored-application
  labels:
    deployment: armored-application
spec:
  replicas: 1
  selector:
    matchLabels:
      kubearmor.io/container.name: armored-container
  template:
    metadata:
      labels:
        kubearmor.io/container.name: armored-container
    spec:
      serviceAccountName: kubearmor
      volumes:
        - emptyDir: {}
          name: kubearmor-dir
      initContainers:
        - name: bluelock
          image: daemon1024/bluelock
          imagePullPolicy: Always
          volumeMounts:
            - mountPath: /kubearmor
              name: kubearmor-dir
      containers:
        - name: armored-container
          image: daemon1024/ka-socat-demo
          imagePullPolicy: Always
          command: ["/kubearmor/bluelock","socat", "TCP-LISTEN:1337,reuseaddr,fork", "EXEC:bash,pty,stderr,setsid,sigint,sane"]
          ports:
            - containerPort: 1337
          volumeMounts:
            - mountPath: /kubearmor
              name: kubearmor-dir
          env:
          - name: "SIDEKICK_URL"
            value: "http://kubearmor.kube-system.svc.cluster.local:2801"
            #- name: sidekick-container
            #  image: falcosecurity/falcosidekick:latest
            #  ports:
            #    - name: sidekick-port
            #      containerPort: 2801
            #  env:
            #    - name: "DEBUG"
            #      value: "true"
            #    - name: "DISCORD_WEBHOOKURL"
            #      value: "https://discord.com/api/webhooks/1093242887153659965/WYPwFw34KfU-2p587Iw1b9hrn2t8cEqsNzoBmaZiHqRvNGwN3neAIQjBd8PxlR_n0qrh"
            #    - name: "DISCORD_MINIMUMPRIORITY"
            #      value: "debug"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubearmor-clusterrolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubearmor
  namespace: default
- kind: ServiceAccount
  name: kubearmor
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubearmor
  namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubearmor
  namespace: kube-system