apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: nfd
  name: nfd-topology-updater
  namespace: node-feature-discovery
spec:
  selector:
    matchLabels:
      app: nfd-topology-updater
  template:
    metadata:
      labels:
        app: nfd-topology-updater
    spec:
      containers:
      - args:
        - -server=nfd-master:$(NFD_MASTER_SERVICE_PORT)
        - -kubelet-config-file=/host-var/lib/kubelet/config.yaml
        - -podresources-socket=/host-var/lib/kubelet/pod-resources/kubelet.sock
        - -sleep-interval=3s
        command:
        - nfd-topology-updater
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        image: $(NODE_FEATURE_DISCOVERY_IMAGE)
        imagePullPolicy: Always
        name: nfd-topology-updater
        securityContext:
          seLinuxOptions:
            type: "container_runtime_t"
          allowPrivilegeEscalation: true
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsUser: 0
        volumeMounts:
        - mountPath: "/host-var/lib/kubelet/config.yaml"
          name: kubelet-podresources-conf
          readOnly: true
        - mountPath: /host-var/lib/kubelet/pod-resources/kubelet.sock
          name: kubelet-podresources-sock
        - mountPath: /host-sys
          name: host-sys
      dnsPolicy: ClusterFirstWithHostNet
      serviceAccount: nfd-topology-updater
      volumes:
      - hostPath:
          path: /sys
          type: Directory
        name: host-sys
      - hostPath:
          path: "/etc/kubernetes/kubelet.conf"
          type: File
        name: kubelet-podresources-conf
      - hostPath:
          path: /var/lib/kubelet/pod-resources/kubelet.sock
          type: Socket
        name: kubelet-podresources-sock
