apiVersion: apps/v1
kind: Deployment
metadata:
  name: flink-taskmanager
spec:
  replicas: 1
  selector:
    matchLabels:
      app: analytics-zoo-ppml-trusted-realtime-ml-graphene
      component: taskmanager
  template:
    metadata:
      labels:
        app: analytics-zoo-ppml-trusted-realtime-ml-graphene
        component: taskmanager
    spec:
      tolerations:
      - key: sgx.intel.com/epc
        operator: Exists
        effect: NoSchedule
      containers:
      - name: taskmanager
        image: 10.239.45.10/arda/intelanalytics/analytics-zoo-ppml-trusted-realtime-ml-scala-graphene:0.12.0-SNAPSHOT
        command: ["/bin/bash","-c"]
        args:
              - export FLINK_JOB_MANAGER_IP=flink-jobmanager;
                cd /ppml/trusted-realtime-ml/java;
                bash init-java.sh | tee ../init-java.log ;
                bash start-flink-taskmanager.sh | tee ../taskmanager.log;
                tail -f /dev/null
#        args: ["export FLINK_JOB_MANAGER_IP=flink-jobmanager; tail -f /dev/null"]
        ports:
        - containerPort: 6122
          name: rpc
        - containerPort: 6125
          name: query-state
#        resources:
#          requests:
#            cpu: 10
#            memory: 128G
#            sgx.intel.com/epc: 133258905600
#          limits:
#            cpu: 12
#            memory: 128G
#            sgx.intel.com/epc: 133258905600
#        livenessProbe:
#          tcpSocket:
#            port: 6122
#          initialDelaySeconds: 30
#          periodSeconds: 60
        securityContext:
          privileged: true
        volumeMounts:
        - name: flink-config-volume
          mountPath: /opt/flink/conf/
        - name: enclave-keys
          mountPath: /graphene/Pal/src/host/Linux-SGX/signer/enclave-key.pem
        - name: java-secure-keys
          mountPath: /ppml/trusted-realtime-ml/java/work/keys
        - name: java-secure-password
          mountPath: /ppml/trusted-realtime-ml/java/work/password
        - name: device-plugin
          mountPath: /var/lib/kubelet/device-plugins
        - name: dev-gsgx
          mountPath: /dev/gsgx
        - name: aesm-socket
          mountPath: /var/run/aesmd/aesm.socket
#        securityContext:
#          runAsUser: 9999  # refers to user _flink_ from official flink image, change if necessary
      volumes:
      - name: flink-config-volume
        configMap:
          name: flink-config
          items:
          - key: flink-conf.yaml
            path: flink-conf.yaml
          - key: log4j-console.properties
            path: log4j-console.properties
      - name: enclave-keys
        hostPath:
          path: path_to_enclave-key.pem
      - name: java-secure-keys
        secret:
          secretName: ssl-keys
      - name: java-secure-password
        secret:
          secretName: ssl-password
      - name: device-plugin
        hostPath:
          path: /var/lib/kubelet/device-plugins
      - name: dev-gsgx
        hostPath:
          path: /dev/gsgx
      - name: aesm-socket
        hostPath:
          path: /var/run/aesmd/aesm.socket

