apiVersion: apps/v1
kind: Deployment
metadata:
  name: flink-jobmanager
spec:
  replicas: 1
  selector:
    matchLabels:
      app: analytics-zoo-ppml-trusted-realtime-ml-graphene
      component: jobmanager
  template:
    metadata:
      labels:
        app: analytics-zoo-ppml-trusted-realtime-ml-graphene
        component: jobmanager
    spec:
      tolerations:
      - key: sgx.intel.com/epc
        operator: Exists
        effect: NoSchedule
      containers:
      - name: jobmanager
        image: 10.239.45.10/arda/intelanalytics/analytics-zoo-ppml-trusted-realtime-ml-scala-graphene:0.12.0-SNAPSHOT
        command: ["/bin/bash","-c"]
        args: 
          - export FLINK_JOB_MANAGER_IP=0.0.0.0; 
            cd /ppml/trusted-realtime-ml/java; 
            bash init-java.sh 2> ../init-java.sh ; 
            bash start-flink-jobmanager.sh | tee ../jobmanager.log; 
            tail -f /dev/null
#        args: ["tail -f /dev/null"]
        securityContext:
          privileged: true
        resources:
          requests:
            cpu: 10
            sgx.intel.com/epc: 133258905600
          limits:
            cpu: 12
            sgx.intel.com/epc: 133258905600
        ports:
        - containerPort: 6123
          name: rpc
        - containerPort: 6124
          name: blob-server
        - containerPort: 8081
          name: webui
#        livenessProbe:
#          tcpSocket:
#            port: 6123
#          initialDelaySeconds: 30
#          periodSeconds: 60
#        securityContext:
#          runAsUser: 9999  # refers to user _flink_ from official flink image, change if necessary
        volumeMounts:
        - name: flink-config-volume
          mountPath: /opt/flink/conf
        - name: enclave-keys
          mountPath: /graphene/Pal/src/host/Linux-SGX/signer/enclave-key.pem
        - name: java-secure-keys
          mountPath: /ppml/trusted-realtime-ml/java/work/keys
        - name: java-secure-password
          mountPath: /ppml/trusted-realtime-ml/java/work/password
        - name: device-plugin
          mountPath: /var/lib/kubelet/device-plugins
        - name: dev-gsgx
          mountPath: /dev/gsgx
        - name: aesm-socket
          mountPath: /var/run/aesmd/aesm.socket
      volumes:
      - name: enclave-keys
        hostPath:
          path: path_to_enclave-key.pem
      - name: java-secure-keys
        secret:
          secretName: ssl-keys
      - name: java-secure-password
        secret:
          secretName: ssl-password
      - name: device-plugin
        hostPath:
          path: /var/lib/kubelet/device-plugins
      - name: dev-gsgx
        hostPath:
          path: /dev/gsgx
      - name: aesm-socket
        hostPath:
          path: /var/run/aesmd/aesm.socket
      - name: flink-config-volume
        configMap:
          name: flink-config
          items:
          - key: flink-conf.yaml
            path: flink-conf.yaml
          - key: log4j-console.properties
            path: log4j-console.properties
