# Copyright 2020 Google LLC
# 
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# 
#     https://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ctf-daemon
  namespace: kube-system
  labels:
    k8s-app: ctf-daemon
spec:
  selector:
    matchLabels:
      name: ctf-daemon
  template:
    metadata:
      labels:
        name: ctf-daemon
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
      - name: ctf-daemon
        image: eu.gcr.io/google_containers/apparmor-loader
        securityContext:
          privileged: true
        command: ["sh", "-c", "while true; do for f in /profiles/*; do echo \"loading $f\"; apparmor_parser -r $f; sleep 30; done; done"]
        volumeMounts:
        - name: sys
          mountPath: /sys
          readOnly: true
        - name: apparmor-includes
          mountPath: /etc/apparmor.d
          readOnly: true
        - name: profiles
          mountPath: /profiles
          readOnly: true
      volumes:
      - name: sys
        hostPath:
          path: /sys
      - name: apparmor-includes
        hostPath:
          path: /etc/apparmor.d
      - name: profiles
        configMap:
          name: apparmor-profiles
