apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: machine-config-daemon
  namespace: {{.TargetNamespace}}
spec:
  selector:
    matchLabels:
      k8s-app: machine-config-daemon
  template:
    metadata:
      name: machine-config-daemon
      labels:
        k8s-app: machine-config-daemon
    spec:
      containers:
      - name: machine-config-daemon
        image: {{.Images.MachineConfigOperator}}
        command: ["/usr/bin/machine-config-daemon"]
        args:
          - "start"
        resources:
          requests:
            cpu: 20m
            memory: 50Mi
        securityContext:
          privileged: true
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
          - mountPath: /rootfs
            name: rootfs
        env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
      - name: oauth-proxy
        image: {{.Images.OauthProxy}}
        ports:
        - containerPort: 9001
          name: metrics
          protocol: TCP
        args:
        - --https-address=:9001
        - --provider=openshift
        - --openshift-service-account=machine-config-daemon
        - --upstream=http://127.0.0.1:8797
        - --tls-cert=/etc/tls/private/tls.crt
        - --tls-key=/etc/tls/private/tls.key
        - --cookie-secret-file=/etc/tls/cookie-secret/cookie-secret
        - '--openshift-sar={"resource": "namespaces", "verb": "get"}'
        - '--openshift-delegate-urls={"/": {"resource": "namespaces", "verb": "get"}}'
        resources:
          requests:
            cpu: 20m
            memory: 50Mi
        volumeMounts:
        - mountPath: /etc/tls/private
          name: proxy-tls
        - mountPath: /etc/tls/cookie-secret
          name: cookie-secret
      hostNetwork: true
      hostPID: true
      serviceAccountName: machine-config-daemon
      terminationGracePeriodSeconds: 600
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: "system-node-critical"
      volumes:
        - name: rootfs
          hostPath:
            path: /
        - name: proxy-tls
          secret:
            secretName: proxy-tls
        - name: cookie-secret
          secret:
            secretName: cookie-secret
      tolerations:
      # MCD needs to run everywhere. Tolerate all taints.
      - operator: Exists