apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: semaphore-wireguard
  labels:
    app: semaphore-wireguard
spec:
  selector:
    matchLabels:
      app: semaphore-wireguard
  template:
    metadata:
      labels:
        app: semaphore-wireguard
    spec:
      serviceAccountName: semaphore-wireguard
      hostNetwork: true
      containers:
        - name: semaphore-wireguard
          image: semaphore-wireguard
          imagePullPolicy: Always
          env:
            - name: SWG_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: SWG_CLUSTERS_CONFIG
              value: "/etc/semaphore-wireguard/config.json"
          ports:
            - name: readiness-port
              containerPort: 7773
          volumeMounts:
            - name: var-lib-semaphore-wireguard
              mountPath: /var/lib/semaphore-wiregurad
            - name: remote-token
              mountPath: /etc/semaphore-wireguard/tokens/remote/
              readOnly: true
            - name: config
              mountPath: /etc/semaphore-wireguard/
          securityContext:
            capabilities:
              add:
                - 'NET_ADMIN'
          livenessProbe:
            httpGet:
              path: /healthz
              port: readiness-port
            periodSeconds: 30
            failureThreshold: 6
            initialDelaySeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
      volumes:
        - name: var-lib-semaphore-wireguard
          hostPath:
            path: /var/lib/semaphore-wireguard
        - name: remote-token
          secret:
            secretName: semaphore-wireguard-token-remote
        - name: config
          configMap:
            name: semaphore-wireguard-config
