apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: dfdaemon
  labels:
    app: dragonfly
    component: dfdaemon
spec:
  selector:
    matchLabels:
      app: dragonfly
      component: dfdaemon
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 10
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: dragonfly
        component: dfdaemon
    spec:
      serviceAccountName: dfdaemon
      containers:
      - name: dfdaemon
        image: dragonflyoss/dfdaemon
        imagePullPolicy: "Always"
        ports: # 65001 is in host network, no need here
        - containerPort: 65000
        - containerPort: 65002
        volumeMounts:
        - name: config
          mountPath: /etc/dragonfly
        - name: netns # the mountPath is setting in proxy.tcpListen.namespace
          mountPath: /host/ns
        securityContext:
          # FIXME dfget daemon only need /proc/1/ns/net and CAP_SYS_ADMIN
          # but containerd resolves the symbolic of /proc/1/ns/net from v1.5.0
          # due to /proc/1/ns/net is not a regular symbolic link, it always failed.
          # https://github.com/containerd/containerd/blob/v1.5.0/pkg/cri/opts/spec_linux.go#L171
          privileged: true
          #capabilities:
          #  add:
          #  - SYS_ADMIN
      volumes:
      - name: config
        configMap:
          name: dfdaemon
      - name: netns
        hostPath:
          path: /proc/1/ns # bind mount host net ns to pod, dfdaemon can listen 65001 in host network
