debug.yml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: debug
spec:
  selector:
    matchLabels:
      app: debug
  template:
    metadata:
      labels:
        app: debug
      name: debug
    spec:
      containers:
        - name: linux
          image: archlinux:latest
          imagePullPolicy: Always
          workingDir: /mnt/pandit
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
          ports:
            - containerPort: 50122
              hostPort: 50122
            - containerPort: 50121
              hostPort: 50121
          args:
            - ./target/debug/panditd 
            - -c
            - .pandit.docker.yml
            - --k8s
            # - --level
            # - TRACE
          securityContext:
            privileged: true
            runAsGroup: 0
            runAsUser: 0
          volumeMounts:
            - mountPath: /mnt/pandit
              name: host
      volumes:
        - hostPath:
            path: /pandit
          name: host
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  namespace: default
  name: pod-reader
rules:
  - apiGroups: [""] 
    resources: ["pods", "nodes"]
    verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: "ServiceAccount"
    name: "default"
    namespace: "default"
roleRef:
  kind: ClusterRole 
  name: pod-reader 
  apiGroup: rbac.authorization.k8s.io