---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: kubeception-kubelet
  namespace: kubeception
spec:
  replicas: 1
  selector: 
    matchLabels:
      role.kubeception: kubelet
  template:
      metadata:
        namespace: kubeception
        name: kubeception-kubelet
        labels: 
          role.kubeception: kubelet
          tier: worker-plane
          component: kubelet
      spec:
        containers:
          - name: hyperkube-kubelet
            image: k8s.gcr.io/hyperkube:v1.11.0
            command:
              - '/hyperkube'
              - 'kubelet'
              - '--allow-privileged=false'  # don't allow the guest to run privileged.
              - '--fail-swap-on=false'  # XXX for local testing only
              - '--kubeconfig=/var/lib/kubelet/runtime.kubeconfig'
              - '--client-ca-file=/opt/kubernetes/certs/ca.crt'
              - '--docker-endpoint=$(DOCKER_HOST)'
              - '--bootstrap-kubeconfig=/opt/kubernetes/certs/bootstrap.kubeconfig'
              - '--v=2'
              # TODO: provide certificates with IP SAN for kubelet nodes.
              # TODO: offer a config file
              # https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/
            securityContext:
              privileged: true  # required for kubelet to expored shared mounts
            ports:
              - name: https
                containerPort: 10250
              - name: healthz
                containerPort: 10248
              - name: readonly
                containerPort: 10255
            volumeMounts:
              - mountPath: /opt/kubernetes/certs
                name: kubeconfig
              - name: docker-storage
                mountPath: /var/lib/docker
              - name: kubestorage
                mountPath: /var/lib/kubelet
            env:
              - name: API_SERVER
                value: https://kubernetes-kubeception:443/
              - name: DOCKER_HOST
                value: tcp://localhost:2375
          - name: hyperkube-proxy
            image: k8s.gcr.io/hyperkube:v1.11.0
            command:
                - '/hyperkube'
                - 'kube-proxy' # TODO: use a configfile here instead too. flags are deprecated.
                - '--proxy-mode=userspace'
                - '--master=https://kubernetes-kubeception:443'
                - '--kubeconfig=/opt/kubernetes/certs/proxy.kubeconfig'
            securityContext:
              privileged: true
            volumeMounts:
              - mountPath: /opt/kubernetes/certs
                name: kubeconfig
          - name: kubeception-docker-daemon  # this container serves 2375
            image: docker:1.13.1-dind
            resources:
              requests:
                cpu: 20m
                memory: 512Mi
            securityContext:
              privileged: true # required for docker to run...
            volumeMounts:
              - name: docker-storage
                mountPath: /var/lib/docker
              - name: kubestorage
                mountPath: /var/lib/kubelet
          - name: kubeception-docker-service
            image: docker:1.13.1
            command: ['docker', 'run', '-p', '80:80', 'httpd:latest']
            resources:
              requests:
                cpu: 10m
                memory: 512Mi
            env:
              - name: DOCKER_HOST
                value: tcp://localhost:2375
        volumes:
        - name: kubeconfig
          secret:
            secretName: kubelet.kubeception
        - name: docker-storage
          emptyDir: {}
        - name: kubestorage
          emptyDir: {}
