apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: nfd-master
  name: nfd-master
spec:
  selector:
    matchLabels:
      app: nfd-master
  template:
    metadata:
      labels:
        app: nfd-master
    spec:
      serviceAccount: nfd-master
      nodeSelector:
        node-role.kubernetes.io/master: ""
      tolerations:
        - key: "node-role.kubernetes.io/master"
          operator: "Equal"
          value: ""
          effect: "NoSchedule"
      containers:
        - env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          image: $(NODE_FEATURE_DISCOVERY_IMAGE)
          name: nfd-master
          command: ["nfd-master", "--extra-label-ns=nvidia.com"]
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
