apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tunnel-mengxin-pink-daemonset
  namespace: web
  labels:
    app: tunnel
spec:
  selector:
    matchLabels:
      pod: tunnel-mengxin-pink
  template:
    metadata:
      annotations:
        linkerd.io/inject: enabled
      labels:
        pod: tunnel-mengxin-pink
    spec:
      containers:
        - name: tunnel-mengxin-pink
          image: erisamoe/cloudflared:latest
          imagePullPolicy: Always
          command: [ "/cloudflared", "--no-autoupdate","tunnel","run","--token","$(SERVICE_KEY)" ]
          resources:
            limits:
              memory: "128Mi"
              cpu: "500m"
          securityContext:
            allowPrivilegeEscalation: false
            # runAsNonRoot: true
            readOnlyRootFilesystem: true
          env:
            - name: SERVICE_KEY
              valueFrom:
                configMapKeyRef:
                  name: tunnel-mengxin-pink-configmap
                  key: service-key
      # restartPolicy: Never

