apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: pan-ngfw-ds
  namespace: kube-system
  labels:
      app: pan-ngfw
spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  selector:
    matchLabels:
      app: pan-ngfw
  template:
    metadata:
      labels:
        app: pan-ngfw
      annotations:
          # Application Pods and Namespaces with annotation
          #     paloaltonetworks.com/firewall: pan-fw*
          # will be secured when this daemonset is running with exact same
          # annotation on the node. The value must start with "pan-fw" as prefix
          # This needs to be in the list of "firewall" in pan-cni-configmap.yaml
          paloaltonetworks.com/firewall: pan-fw

          # Below annotation is always fixed and is used to detect this Daemonset.
          #     paloaltonetworks.com/app: pan-fw
          # After k8s plugin change, change this to following to avoid confusion:
          #     paloaltonetworks.com/app: pan-ngfw-app
          paloaltonetworks.com/app: pan-fw

          # This annotation enables pan-cni CNI plugin for this pod
          # This needs to be done after NetworkAttachmentDefinition pan-cni
          # (pan-cni-net-attach-def.yaml) has been deployed in the same
          # namespace as this pod.
          # These 2 steps are needed for app pod and their namespace as well.
          k8s.v1.cni.cncf.io/networks: pan-cni
    spec:
      priorityClassName: system-cluster-critical
      # Minimize downtime during a rolling upgrade or deletion; Can tell Kubernetes
      # to do a "force deletion": 
      # https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
      # but for now allowing 10 seconds to do graceful removal of the slots by 
      # sending dereg to PAN-MGMT
      terminationGracePeriodSeconds: 10
      hostAliases:
      # Internal IP address of ipsec0 interface on MGMT pod
      - ip: "169.254.202.1"
        hostnames:
          - mgmt
      #nodeSelector:  
      #  firewall: pan-ngfw-ds
      containers:
        - name: pan-ngfw-container
          image: <your-private-registry-image-path>
          command: ["/sbin/pan_pause"]
          lifecycle:
            preStop:
              exec:
                command: ["/bin/bash","-c","/sbin/pan_command pan_shutdown"]
          readinessProbe:
            exec:
              command: ["/sbin/pan_ready_check"]
            initialDelaySeconds: 15
            periodSeconds: 2
            failureThreshold: 1
            successThreshold: 2
          livenessProbe:
            exec:
              command: ["/sbin/pan_alive_check"]
            initialDelaySeconds: 600 #covers image download and panos start
            periodSeconds: 5
            # liveness is still the indicator of the container's health.
            failureThreshold: 2
          imagePullPolicy: Always
          securityContext:
            capabilities:
              add: ["ALL"]
            privileged: true
            runAsNonRoot: false
          resources:
            requests:
              # configurable based on desired throughput, number of running pods
              cpu: "1"
              memory: "2Gi"
            limits:
              cpu: "1"
              memory: "2.25Gi"
          volumeMounts:
          - mountPath: /opt/appinfo
            name: appinfo
          - mountPath: /dev/net/tun
            name: devnettun
            readOnly: false
          - mountPath: /dev/shm
            name: dshm
          - mountPath: /etc/pan-fw-sw
            name: sw-secret
          envFrom:
          - configMapRef:
              name: pan-ngfw-config
          env:
            - name: CPU_REQUEST
              valueFrom:
                resourceFieldRef:
                  containerName: pan-ngfw-container
                  resource: requests.cpu
            - name: CPU_LIMIT
              valueFrom:
                resourceFieldRef:
                  containerName: pan-ngfw-container
                  resource: limits.cpu
            - name: MEMORY_REQUEST
              valueFrom:
                resourceFieldRef:
                  containerName: pan-ngfw-container
                  resource: requests.memory
            - name: MEMORY_LIMIT
              valueFrom:
                resourceFieldRef:
                  containerName: pan-ngfw-container
                  resource: limits.memory
            - name: MY_POD_UUID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
            - name: MY_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: MY_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: MY_POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: MY_POD_SERVICE_ACCOUNT
              valueFrom:
                fieldRef:
                  fieldPath: spec.serviceAccountName
            - name: MY_POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
      volumes:
      - name: devnettun
        hostPath:
          path: /dev/net/tun
      - name: dshm
        emptyDir:
          medium: Memory
      - name: appinfo
        hostPath:
          # app pod info's directory location on host
          # below path should match pan-cni's "appinfo" volume and 
          # "appinfo_dir" configmap and pan-ngfw-ds's part of "pan-cni-ready" volume
          path: /var/log/pan-appinfo
          type: Directory
      - name: sw-secret
        secret:
          # Don't change this. Needs to match PAN_DP_NAME in pan-cn-mgmt.yaml
          # followed by suffix "-sw". Also hard-coded in ipsec.conf
          secretName: pan-fw-sw
