# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


# Deploy this DaemonSet to disable hyper-threading on the nodes with the
# "cloud.google.com/gke-smt-disabled=true" label.
#
# WARNING: Disabling hyper-threading might have severe performance impact on
# your clusters and application. Please ensure that this is acceptable before
# deploying this to your production clusters.

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: disable-smt
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: disable-smt
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: disable-smt
    spec:
      hostNetwork: true
      hostPID: true
      tolerations:
      - operator: Exists
      initContainers:
      - name: disable-smt
        image: ubuntu
        securityContext:
          runAsUser: 0
          privileged: true
        command:
        - chroot
        - /root
        - /bin/bash
        - -c
        - |
          SMT_CONTROL_PATH=/sys/devices/system/cpu/smt/control 
          echo "on" > "${SMT_CONTROL_PATH}"
          echo "wrote \"off\" to ${SMT_CONTROL_PATH}"

          # Restart kubelet so it picks up changes to # of CPUs.
          echo "restarting kublet"
          systemctl restart kubelet
          echo "restarted kubelet"
        volumeMounts:
        - mountPath: /root
          name: root
        - mountPath: /run
          name: run
      containers:
      - image: gcr.io/google-containers/pause:2.0
        name: pause
      # Ensures that the pods will only run on the nodes having the certain
      # label.
      nodeSelector:
        "cloud.google.com/gke-smt-disabled": "false"
      volumes:
      - hostPath:
          path: /
          type: ""
        name: root
      - hostPath:
          path: /run
          type: ""
        name: run
