apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: privileged-example
spec:
  selector:
    matchLabels:
      app: privileged-example
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      # allow 100% of the pods to be unavailable during upgrade
      maxUnavailable: "100%"
  template:
    metadata:
      labels:
        app: privileged-example
    spec:
      # on termination - wait 1 second before force killing the pod
      terminationGracePeriodSeconds: 1
      # don't mount the kubernetes token on the pod
      automountServiceAccountToken: false
      # give host privileges to the all the pod containers
      hostNetwork: true
      hostPID: true
      hostIPC: true
      # we use initContainer because we need to run this just once
      initContainers:
      - name: init
        # this is a very small image with basic shell tools
        image: alpine:3.12.2
        # give extra privileges to the container
        securityContext:
          privileged: true
        # this command copies some files to the host and then runs commands on the host
        command:
        - sh
        - -c
        - |
          cp /tmp/config.json /host/var/lib/kubelet/config.json &&\
          mkdir -p /host/root/.docker &&\
          cp /tmp/config.json /host/root/.docker/config.json &&\
          chroot /host bash -c "
            apt-get update &&\
            apt-get install -y nfs-common
          "
        volumeMounts:
        - name: hostfs
          mountPath: /host
        - name: pullsecret
          mountPath: "/tmp/config.json"
          subPath: ".dockerconfigjson"
      containers:
      # once we ran the initContainer we need to keep it running otherwise Kubernetes will keep restarting it
      - name: pause
        image: busybox
        command: ["sh", "-c", "while true; do sleep 86400; done"]
      volumes:
      - name: hostfs
        # we use a hostPath to get the host root directory inside the container
        hostPath:
          path: /
      - name: pullsecret
        secret:
          secretName: github
