apiVersion: apps/v1
kind: Deployment
metadata:
  name: master-deployment
spec:
  selector:
    matchLabels:
      app: analytics-zoo-ppml-trusted-realtime-ml-graphene
  replicas: 1
  template:
    metadata:
      labels:
        app: analytics-zoo-ppml-trusted-realtime-ml-graphene
    spec:
      tolerations:
      - key: sgx.intel.com/epc
        operator: Exists
        effect: NoSchedule
      containers:
      - name: master-python-graphene
        image: 10.239.45.10/arda/intelanalytics/analytics-zoo-ppml-trusted-realtime-ml-scala-graphene:0.12.0-SNAPSHOT
        command: ["/bin/sh","-c"]
        args: ["bash /ppml/trusted-realtime-ml/start-all-but-flink.sh | tee /ppml/trusted-realtime-ml/log; tail -f /dev/null"]
        securityContext:
          privileged: true
        env:
          - name: FLINK_JOB_MANAGER_IP
            valueFrom:
              configMapKeyRef:
                name: flink-config
                key: flink.jobmanager.ip
          - name: SGX_MODE
            valueFrom:
              configMapKeyRef:
                name: flink-config
                key: sgx.mode
#        resources:
#          requests:
#            cpu: 10
#            sgx.intel.com/epc: 133258905600
#          limits:
#            cpu: 12
#            sgx.intel.com/epc: 133258905600
        volumeMounts:
          - name: device-plugin
            mountPath: /var/lib/kubelet/device-plugins
          - name: dev-gsgx
            mountPath: /dev/gsgx
          - name: entry
            mountPath: /ppml/trusted-realtime-ml/start-all-but-flink.sh
          - name: aesm-socket
            mountPath: /var/run/aesmd/aesm.socket
          - name: enclave-keys
            mountPath: /graphene/Pal/src/host/Linux-SGX/signer/enclave-key.pem
          - name: redis-secure-keys
            mountPath: /ppml/trusted-realtime-ml/redis/work/keys
          - name: redis-secure-password
            mountPath: /ppml/trusted-realtime-ml/redis/work/password
          - name: java-secure-keys
            mountPath: /ppml/trusted-realtime-ml/java/work/keys
          - name: java-secure-password
            mountPath: /ppml/trusted-realtime-ml/java/work/password
      volumes:
      - name: device-plugin
        hostPath:
          path: /var/lib/kubelet/device-plugins
      - name: dev-gsgx
        hostPath:
          path: /dev/gsgx
      - name: aesm-socket
        hostPath:
          path: /var/run/aesmd/aesm.socket
      - name: enclave-keys
        hostPath:
          path: path_to_enclave-key.pem
      - name: entry
        hostPath:
          path: path_to_start-all-but-flink.sh
      - name: redis-secure-keys
        secret:
          secretName: ssl-keys
      - name: redis-secure-password
        secret:
          secretName: ssl-password
      - name: java-secure-keys
        secret:
          secretName: ssl-keys
      - name: java-secure-password
        secret:
          secretName: ssl-password
