#  Copyright (C) 2021 Intel Corporation
#  SPDX-License-Identifier: BSD-3-Clause

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ta-upgrade
  namespace: isecl
  labels:
    run-once-daemonset: ta-upgrade
spec:
  selector:
    matchLabels:
      run-once-daemonset: ta-upgrade
  template:
    metadata:
      labels:
        run-once-daemonset: ta-upgrade
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node.type
                    operator: In
                    values:
                      - "TXT-ENABLED"
                      - "SUEFI-ENABLED"
      initContainers:
        - image: busybox:1.32
          imagePullPolicy: Always
          name: copy-backup
          command: ["/bin/sh", "-c"]
          args:
          - >
            cp -r /opt/trustagent/* /tmp/trustagent_backup/
          volumeMounts:
            - name: ta-volume
              mountPath: /opt/trustagent
            - name: ta-backup-volume
              mountPath: /tmp/trustagent_backup
        - name: ta-upgrade
          image: <image-name>:<tag>
          imagePullPolicy: Always
          command: ["/container_upgrade.sh"]
          securityContext:
            privileged: true
          env:
            - name: CONFIG_DIR
              value: "/opt/trustagent"
            - name: COMPONENT_VERSION
              value: <component-exising-installed-version>
          volumeMounts:
          - name: ta-logs-volume
            mountPath: /var/log/trustagent/
          - name: ta-volume
            mountPath: /opt/trustagent
          - name: tpmrm
            mountPath: /dev/tpmrm0
          - name: ta-secrets
            mountPath: /etc/secrets/
      containers:
        - name: pause
          image: gcr.io/google_containers/pause
      volumes:
        - name: ta-logs-volume
          hostPath:
            path: /var/log/trustagent
            type: Directory
        - name: ta-volume
          hostPath:
            path: /opt/trustagent
            type: Directory
        - name: tpmrm
          hostPath:
            path: /dev/tpmrm0
        - name: ta-backup-volume
          hostPath:
            path: /tmp/trustagent_backup
            type: DirectoryOrCreate
        - name: ta-secrets
          projected:
            sources:
              - secret:
                  name: ta-credentials
              - secret:
                  name: bearer-token