daemonset.yaml

# ServiceAccount for DaemonSet.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: storageos-daemonset-sa
  namespace: default

---

# ClusterRole for init container.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: init-container
rules:
- apiGroups:
  - apps
  resources:
  - daemonsets
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - get
  - list
  - delete

---

# Bind DaemonSet ServiceAccount with init-container ClusterRole.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: init-container
subjects:
- kind: ServiceAccount
  name: storageos-daemonset-sa
  namespace: default
roleRef:
  kind: ClusterRole
  name: init-container
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: storageos-daemonset
  labels:
    app: storageos-daemonset
spec:
  selector:
    matchLabels:
      name: storageos-daemonset
  template:
    metadata:
      labels:
        name: storageos-daemonset
    spec:
      serviceAccountName: storageos-daemonset-sa
      initContainers:
      - name: storageos-init
        image: storageos/init:test
        env:
          - name: DAEMONSET_NAME
            value: storageos-daemonset
          - name: DAEMONSET_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: MINIMUM_MAX_PIDS_LIMIT
            value: "1024"          
          - name: RECOMMENDED_MAX_PIDS_LIMIT
            value: "4096"          
        volumeMounts:
          - name: kernel-modules
            mountPath: /lib/modules
            readOnly: true
          - name: sys
            mountPath: /sys
            mountPropagation: Bidirectional
          - name: state
            mountPath: /var/lib/storageos
            mountPropagation: Bidirectional
        securityContext:
          privileged: true
          capabilities:
            add:
            - SYS_ADMIN
      containers:
      - name: storageos
        image: busybox
        imagePullPolicy: IfNotPresent
        args:
          - sleep
          - "600"
      volumes:
        - name: kernel-modules
          hostPath:
            path: /lib/modules
        - name: sys
          hostPath:
            path: /sys
        - name: state
          hostPath:
            path: /var/lib/storageos
  updateStrategy:
    type: OnDelete