apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: intel-sgx-plugin
  namespace: kube-system
  labels:
    app: intel-sgx-plugin
spec:
  selector:
    matchLabels:
      app: intel-sgx-plugin
  template:
    metadata:
      labels:
        app: intel-sgx-plugin
    spec:
      containers:
        - name: intel-sgx-plugin
          image: "{{ .Values.plugin.image.repository }}:{{ .Values.plugin.image.tag }}"
          securityContext:
            readOnlyRootFilesystem: true
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: kubeletsockets
              mountPath: /var/lib/kubelet/device-plugins
            - name: sgxdevices
              mountPath: /dev/sgx
              readOnly: true
            - name: sgx-enclave
              mountPath: /dev/sgx_enclave
              readOnly: true
            - name: sgx-provision
              mountPath: /dev/sgx_provision
              readOnly: true
      volumes:
        - name: kubeletsockets
          hostPath:
            path: /var/lib/kubelet/device-plugins
        - name: sgxdevices
          hostPath:
            path: /dev/sgx
            type: DirectoryOrCreate
        - name: sgx-enclave
          hostPath:
            path: /dev/sgx_enclave
            type: CharDevice
        - name: sgx-provision
          hostPath:
            path: /dev/sgx_provision
            type: CharDevice
      nodeSelector:
        sgx.intel.com/capable: 'true'
