---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: vizier-pem
spec:
  selector:
    matchLabels:
      name: vizier-pem
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 20
  template:
    metadata:
      labels:
        name: vizier-pem
        plane: data
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: Exists
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
            - matchExpressions:
              - key: beta.kubernetes.io/os
                operator: Exists
              - key: beta.kubernetes.io/os
                operator: In
                values:
                - linux
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      - operator: Exists
        effect: NoExecute
      - operator: Exists
        effect: NoSchedule
      initContainers:
      - name: qb-wait
        image: songyc31/curl:1.0
        # yamllint disable
        command: ['sh', '-c', 'set -x;
          URL="https://${SERVICE_NAME}:${SERVICE_PORT}/healthz";
          until [ $(curl -m 0.5 -s -o /dev/null -w "%{http_code}" -k ${URL}) -eq 200 ]; do
            echo "waiting for ${URL}"
            sleep 2;
          done;
        ']
        env:
        - name: SERVICE_NAME
          value: "vizier-query-broker-svc"
        - name: SERVICE_PORT
          value: "50300"
      containers:
      - name: pem
        image: gcr.io/pixie-oss/pixie-dev/vizier/pem_image:latest
        args: []
        env:
        - name: TCMALLOC_SAMPLE_PARAMETER
          value: "1048576"
        - name: PL_CLIENT_TLS_CERT
          value: /certs/client.crt
        - name: PL_CLIENT_TLS_KEY
          value: /certs/client.key
        - name: PL_TLS_CA_CERT
          value: /certs/ca.crt
        - name: PL_DISABLE_SSL
          value: "false"
        - name: PL_HOST_PATH
          value: "/host"
        - name: PL_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PL_HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: PL_JWT_SIGNING_KEY
          valueFrom:
            secretKeyRef:
              key: jwt-signing-key
              name: pl-cluster-secrets
        - name: PL_CLOCK_CONVERTER
          value: "default"
        resources: {}
        securityContext:
          capabilities:
            add:
            - SYS_PTRACE
            - SYS_ADMIN
          privileged: true
        volumeMounts:
        - name: host-root
          mountPath: /host
          readOnly: true
        - name: sys
          mountPath: /sys
          readOnly: true
        - name: certs
          mountPath: /certs
      hostPID: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      terminationGracePeriodSeconds: 10
      volumes:
      - name: host-root
        hostPath:
          path: /
          type: Directory
      - name: sys
        hostPath:
          path: /sys
          type: Directory
      - name: certs
        secret:
          secretName: service-tls-certs
