apiVersion: apps/v1
kind: Deployment
metadata:
  name: terrascan
spec:
  template:
    spec:
      containers:
      - name: terrascan-server
        volumeMounts:
          - mountPath: /etc/ssh-key-secret
            name: ssh-keys
            readOnly: true
          - mountPath: /etc/ssh-known-hosts-secret
            name: ssh-known-hosts
            readOnly: true
        args:
        - >
          cp /etc/ssh-key-secret/private-key /home/terrascan/.ssh/id_ed25519_github &&
          cp /etc/ssh-known-hosts-secret/known-hosts /home/terrascan/.ssh/known_hosts &&
          chmod -R 400 /home/terrascan/.ssh/* &&
          terrascan server --cert-path /data/certs/server.crt --key-path /data/certs/server.key -l debug -c /data/config/config.toml
      volumes:
        #add a configmap for the ssh known_hosts file
        - name: ssh-known-hosts
          configMap:
            name: ssh-known-hosts-config
        # ssh private key for authentication with the repository hosting service
        - name: ssh-keys
          secret:
            secretName: ssh-key-secret
