apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: flatcar-linux-update-agent
  namespace: reboot-coordinator
spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  selector:
    matchLabels:
      app: flatcar-linux-update-agent
  template:
    metadata:
      labels:
        app: flatcar-linux-update-agent
    spec:
      serviceAccountName: flatcar-linux-update-operator-sa
      containers:
      - name: update-agent
        image: quay.io/kinvolk/flatcar-linux-update-operator:v0.7.3
        command:
        - "/bin/update-agent"
        volumeMounts:
          - mountPath: /var/run/dbus
            name: var-run-dbus
            readOnly: false
          - mountPath: /etc/flatcar
            name: etc-flatcar
            readOnly: true
          - mountPath: /usr/share/flatcar
            name: usr-share-flatcar
            readOnly: true
          - mountPath: /etc/os-release
            name: etc-os-release
            readOnly: true
        env:
        # read by update-agent as the node name to manage reboots for
        - name: UPDATE_AGENT_NODE
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        # Update agent must run with a UID that is allowed to reboot nodes via logind using the D-Bus interface.
        # FLUO Docker image runs as 65534 (nobody) by default, so we need to escalate the privileges here,
        # as we cannot ensure, that host configuration of PolicyKit and D-Bus allows UID 65534 to execute that.
        securityContext:
          runAsUser: 0
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      volumes:
      - name: var-run-dbus
        hostPath:
          path: /var/run/dbus
      - name: etc-flatcar
        hostPath:
          path: /etc/flatcar
      - name: usr-share-flatcar
        hostPath:
          path: /usr/share/flatcar
      - name: etc-os-release
        hostPath:
          path: /etc/os-release
