apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cadvisor
  namespace: kube-system
  labels:
    application: cadvisor
    version: v0.33.0-g2ccad4b4-master-4
spec:
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      application: cadvisor
  template:
    metadata:
      labels:
        application: cadvisor
        version: v0.33.0-g2ccad4b4-master-4
    spec:
      hostPID: true
      dnsConfig:
        options:
          - name: ndots
            value: "1"
      priorityClassName: system-node-critical
      serviceAccountName: cadvisor
      containers:
      - name: cadvisor
        # images including https://github.com/google/cadvisor/pull/2113
        image: registry.opensource.zalan.do/teapot/cadvisor:v0.33.0-g2ccad4b4-master-4
        args:
        - --housekeeping_interval=10s
        - --max_housekeeping_interval=15s
        - --event_storage_event_limit=default=0
        - --event_storage_age_limit=default=0
        - --disable_metrics=sched,percpu,tcp,udp
        - --docker_only
        - --raw_cgroup_prefix_whitelist=/system.slice/kubelet.service
        - --store_container_labels=false
        - --whitelisted_container_labels=io.kubernetes.container.name,io.kubernetes.pod.name,io.kubernetes.pod.namespace,io.kubernetes.pod.uid,application
        resources:
          limits:
            cpu: "{{ .ConfigItems.cadvisor_cpu }}"
            memory: "{{ .ConfigItems.cadvisor_memory }}"
          requests:
            cpu: "{{ .ConfigItems.cadvisor_cpu }}"
            memory: "{{ .ConfigItems.cadvisor_memory }}"
        securityContext:
          privileged: true # allows reading /dev/kmsg
        volumeMounts:
        - name: rootfs
          mountPath: /rootfs
          readOnly: true
        - name: var-run
          mountPath: /var/run
          readOnly: true
        - name: sys
          mountPath: /sys
          readOnly: true
        - name: docker
          mountPath: /var/lib/docker
          readOnly: true
        - name: kmsg
          mountPath: /dev/kmsg
          readOnly: true
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      volumes:
      - name: rootfs
        hostPath:
          path: /
      - name: var-run
        hostPath:
          path: /var/run
      - name: sys
        hostPath:
          path: /sys
      - name: docker
        hostPath:
          path: /var/lib/docker
      - name: kmsg
        hostPath:
          path: /dev/kmsg
      tolerations:
      - operator: Exists
        effect: NoSchedule
      - operator: Exists
        effect: NoExecute
