# Copyright (C) 2021  Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ta-daemonset-txt
  namespace: isecl
  labels:
    app: ta-txt
spec:
  selector:
    matchLabels:
      app: ta-txt
  template:
    metadata:
      labels:
        app: ta-txt
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node.type
                    operator: In
                    values:
                      - "TXT-ENABLED"
      tolerations:
      - key: "untrusted"
        operator: "Equal"
        value: "true"
        effect: "NoSchedule"
      - key: "untrusted"
        operator: "Equal"
        value: "true"
        effect: "NoExecute"
      containers:
        - image: <image-name>:<image-tag>
          name: ta-txt
          securityContext:
            privileged: true
          imagePullPolicy: Always
          ports:
            - containerPort: 1443
              hostPort: 31443
          envFrom:
            - configMapRef:
                name: ta-config
          volumeMounts:
            - name: ta-logs-volume
              mountPath: /var/log/trustagent/
            - name: txt-stat
              mountPath: /usr/sbin/txt-stat
            - name: ta-config-volume
              mountPath: /opt/trustagent/configuration
            - mountPath: /dev/tpmrm0
              name: tpmrm
            - mountPath: /etc/hostname
              name: ta-hostname-path
              readOnly: true
            - mountPath: /etc/hosts
              name: ta-hosts-path
              readOnly: true
            - mountPath: /etc/os-release
              name: ta-host-os-path
              readOnly: true
            - mountPath: /dev/mem
              name: ta-mem-path
              readOnly: true
            - mountPath: /sys/firmware/acpi/tables/TPM2
              name: ta-acpi-path
              readOnly: true
            - name: uefi
              mountPath: /sys/firmware/dmi/tables/DMI
              readOnly: true
            - name: wla-config-volume
              mountPath: /etc/workload-agent/
            - mountPath: /etc/secrets/
              name: ta-secrets
              readOnly: true
      volumes:
        - name: ta-logs-volume
          hostPath:
            path: /var/log/trustagent
            type: DirectoryOrCreate
        - name: ta-config-volume
          hostPath:
            path: /opt/trustagent/configuration
            type: DirectoryOrCreate
        - name: tpmrm
          hostPath:
            path: /dev/tpmrm0
        - name: txt-stat
          hostPath:
            path: /usr/sbin/txt-stat
        - name: ta-hostname-path
          hostPath:
            path: /etc/hostname
            type: File
        - name: ta-hosts-path
          hostPath:
            path: /etc/hosts
            type: File
        - name: ta-host-os-path
          hostPath:
            path: /etc/os-release
            type: File
        - name: ta-mem-path
          hostPath:
            path: /dev/mem
        - name: ta-acpi-path
          hostPath:
            path: /sys/firmware/acpi/tables/TPM2
        - name: uefi
          hostPath:
            path: /sys/firmware/dmi/tables/DMI
        - name: wla-config-volume
          hostPath:
            path: /etc/workload-agent
            type: DirectoryOrCreate
        - name: ta-secrets
          projected:
            sources:
              - secret:
                  name: ta-credentials
              - secret:
                  name: bearer-token
