# This manifest provides a daemonset that will ensure the host's sysctls are set
# to M3DB's recommended values.
#
# WARNING: This will run a PRIVILEGED ROOT container on your HOST that will
# modify host sysctl values. This is designed for managed Kubernetes platforms
# that may have restrictions like read-only root FS, inability to set startup
# scripts, etc. In very rare circumstances should you use this, and should
# instead opt to use your usual host provisioning tooling to set these values.
#
# This daemonset pins to a specific SHA digest in the event that the M3DB Quay
# repo is ever compromised. The manifest of this image can be verified here:
# https://quay.io/repository/m3/sysctl-setter/manifest/sha256:e003ee817fa573c38507667ca2e22634a1cb039fdb849f8ac0da98cc254a674e

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: sysctl-setter-ds
  namespace: default
  labels:
    app: sysctl-setter
spec:
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: sysctl-setter
  template:
    metadata:
      labels:
        app: sysctl-setter
    spec:
      terminationGracePeriodSeconds: 5
      containers:
      - image: quay.io/m3/sysctl-setter@sha256:e003ee817fa573c38507667ca2e22634a1cb039fdb849f8ac0da98cc254a674e
        imagePullPolicy: Always
        name: sysctl-setter
        securityContext:
          privileged: true
