apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-analyzer
  namespace: apolicy
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: node-analyzer
  template:
    metadata:
      labels:
        app.kubernetes.io/name: node-analyzer
    spec:
      serviceAccountName: apolicy-analyzer-sa
      hostPID: true
      tolerations:
      # this toleration is to have the daemonset runnable on master nodes
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      containers:
        - name: node-analyzer
          image: local/node-analyzer
          envFrom:
            - secretRef:
                name: apolicy-secret
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: var-lib-etcd
              mountPath: /var/lib/etcd
              readOnly: true
            - name: var-lib-kubelet
              mountPath: /var/lib/kubelet
              readOnly: true
            - name: etc-systemd
              mountPath: /etc/systemd
              readOnly: true
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
              readOnly: true
            - name: etc-cni
              mountPath: /etc/cni
              readOnly: true
      volumes:
        - name: var-lib-etcd
          hostPath:
            path: "/var/lib/etcd"
        - name: var-lib-kubelet
          hostPath:
            path: "/var/lib/kubelet"
        - name: etc-systemd
          hostPath:
            path: "/etc/systemd"
        - name: etc-kubernetes
          hostPath:
            path: "/etc/kubernetes"
        - name: etc-cni
          hostPath:
            path: "/etc/cni"