apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: nfd-worker
  name: nfd-worker
spec:
  selector:
    matchLabels:
      app: nfd-worker
  template:
    metadata:
      labels:
        app: nfd-worker
    spec:
      dnsPolicy: ClusterFirstWithHostNet
      tolerations:
        - operator: "Exists"
          effect: "NoSchedule"
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/master
                    operator: DoesNotExist
              - matchExpressions:
                  - key: node-role.kubernetes.io/worker
                    operator: Exists
      hostNetwork: true
      serviceAccount: nfd-worker
      readOnlyRootFilesystem: true
      containers:
        - env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          image: $(NODE_FEATURE_DISCOVERY_IMAGE)
          name: nfd-worker
          command:
            - "nfd-worker"
          args:
            - "--server=nfd-master:$(NFD_MASTER_SERVICE_PORT)"
          volumeMounts:
            - name: host-boot
              mountPath: "/host-boot"
              readOnly: true
            - name: host-os-release
              mountPath: "/host-etc/os-release"
              readOnly: true
            - name: host-sys
              mountPath: "/host-sys"
            - name: host-usr-lib
              mountPath: "/host-usr/lib"
              readOnly: true
            - name: host-usr-src
              mountPath: "/host-usr/src"
              readOnly: true
            - name: nfd-worker-config
              mountPath: "/etc/kubernetes/node-feature-discovery"
            - name: nfd-hooks
              mountPath: "/etc/kubernetes/node-feature-discovery/source.d"
            - name: nfd-features
              mountPath: "/etc/kubernetes/node-feature-discovery/features.d"
            - name: custom-config
              mountPath: "/etc/kubernetes/node-feature-discovery/custom.d/custom-rules"
              readOnly: true
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: host-boot
          hostPath:
            path: "/boot"
        - name: host-os-release
          hostPath:
            path: "/etc/os-release"
        - name: host-sys
          hostPath:
            path: "/sys"
        - name: host-usr-lib
          hostPath:
            path: "/usr/lib"
        - name: host-usr-src
          hostPath:
            path: "/usr/src"
        - name: nfd-hooks
          hostPath:
            path: "/etc/kubernetes/node-feature-discovery/source.d"
        - name: nfd-features
          hostPath:
            path: "/etc/kubernetes/node-feature-discovery/features.d"
        - name: nfd-worker-config
          configMap:
            name: nfd-worker
            items:
              - key: nfd-worker-conf
                path: nfd-worker.conf
        - name: custom-config
          configMap:
            name: nfd-worker
            items:
              - key: custom-conf
                path: custom.conf
