apiVersion: v1
kind: ServiceAccount
metadata:
  name: noded
  namespace: mindx-dl
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pods-noded-role
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "create", "update", "list", "watch", "delete"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "patch"]
  - apiGroups: [ "" ]
    resources: [ "pods" ]
    verbs: [ "get", "list", "watch", "patch" ]
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs: ["get"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pods-noded-rolebinding
subjects:
  - kind: ServiceAccount
    name: noded
    namespace: mindx-dl
roleRef:
  kind: ClusterRole
  name: pods-noded-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: noded
  namespace: mindx-dl
spec:
  selector:
    matchLabels:
      app: noded
  template:
    metadata:
      labels:
        app: noded
      ##### For Kubernetes versions lower than 1.19, seccomp is used with annotations.
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: runtime/default
    spec:
      ##### For Kubernetes version 1.19 and above, seccomp is used with securityContext:seccompProfile
      #      securityContext:
      #        seccompProfile:
      #          type: RuntimeDefault
      nodeSelector:
        workerselector: dls-worker-node
      serviceAccountName: noded
      hostNetwork: true
      hostPID: true
      initContainers:
        - name: init-log-setup
          image: noded:v6.0.RC1
          command: ['sh', '-c', 'mkdir -p /var/log/mindx-dl && chmod 755 /var/log/mindx-dl && chown root:root /var/log/mindx-dl && mkdir -p /var/log/mindx-dl/noded && chmod 750 /var/log/mindx-dl/noded && chown root:root /var/log/mindx-dl/noded']
          securityContext:
            runAsUser: 0
            runAsNonRoot: false
          volumeMounts:
            - name: log-noded
              mountPath: /var/log
      containers:
        - name: noded
          image: noded:v6.0.RC1
          resources:
            requests:
              memory: 300Mi
              cpu: 500m
            limits:
              memory: 300Mi
              cpu: 500m
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: XDL_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: PATH
              value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
          imagePullPolicy: Never
          command: [ "/bin/bash", "-c", "--"]
          args: [ "/usr/local/bin/noded -logFile=/var/log/mindx-dl/noded/noded.log -logLevel=0 --enable-healthz=true --healthz-address=11255" ]
          livenessProbe:
            httpGet:
              path: /
              port: 11255
              scheme: HTTP
            initialDelaySeconds: 20
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 3
          securityContext:
            privileged: true
          volumeMounts:
            - name: log-noded
              mountPath: /var/log/mindx-dl/noded
              subPath: mindx-dl/noded
            - name: hiai-driver
              mountPath: /usr/local/Ascend/driver
              readOnly: true
            - name: pingmesh-result
              mountPath: /user/mind-cluster/pingmesh
            - name: localtime
              mountPath: /etc/localtime
              readOnly: true
            - name: dev-dir
              mountPath: /dev
            - name: dev-shm
              mountPath: /dev/shm
            - name: slownode
              mountPath: /user/cluster-info/profiling
            - name: image-path
              mountPath: /user/snapshot
            - name: ascend-docker-runtime
              mountPath: /usr/local/Ascend/Ascend-Docker-Runtime
            - name: runtime-log
              mountPath: /var/log/ascend-docker-runtime
            - name: containerd
              mountPath: /run/containerd
              mountPropagation: HostToContainer
            - name: containerd-lib
              mountPath: /var/lib/containerd
              readOnly: true
            - name: runc
              mountPath: /usr/local/bin/runc
            - name: criu
              mountPath: /usr/sbin/criu
            - name: npu-plugin
              mountPath: /usr/lib/criu
            - name: cgroup
              mountPath: /sys/fs/cgroup
            - name: systemd
              mountPath: /run/systemd
            - name: tmp
              mountPath: /tmp
            - name: run
              mountPath: /run
            - name: dcmi
              mountPath: /usr/local/dcmi
            - name: ascend-driver-include
              mountPath: /usr/local/Ascend/driver/include
            - name: var-kubelet
              mountPath: /var/lib/kubelet
      volumes:
        - name: log-noded
          hostPath:
            path: /var/log
            type: Directory
        - name: hiai-driver
          hostPath:
            path: /usr/local/Ascend/driver
        - name: pingmesh-result
          hostPath:
            path: /user/mind-cluster/pingmesh
            type: DirectoryOrCreate
        - name: localtime
          hostPath:
            path: /etc/localtime
        - name: dev-dir
          hostPath:
            path: /dev
            type: Directory
        - name: dev-shm
          hostPath:
            path: /dev/shm
            type: Directory
        - name: slownode
          hostPath:
            path: /user/cluster-info/profiling
            type: DirectoryOrCreate
        - name: image-path
          hostPath:
            path: /user/snapshot
            type: Directory
        - name: ascend-docker-runtime
          hostPath:
            path: /usr/local/Ascend/Ascend-Docker-Runtime
            type: Directory
        - name: runtime-log
          hostPath:
            path: /var/log/ascend-docker-runtime
            type: Directory
        - name: containerd
          hostPath:
            path: /run/containerd
            type: Directory
        - name: containerd-lib
          hostPath:
            path: /var/lib/containerd
            type: Directory
        - name: runc
          hostPath:
            path: /usr/local/bin/runc
        - name: criu
          hostPath:
            path: /usr/sbin/criu
        - name: npu-plugin
          hostPath:
            path: /usr/lib/criu
            type: Directory
        - name: cgroup
          hostPath:
            path: /sys/fs/cgroup
            type: Directory
        - name: systemd
          hostPath:
            path: /run/systemd
            type: Directory
        - name: tmp
          hostPath:
            path: /tmp
            type: Directory
        - name: run
          hostPath:
            path: /run
            type: Directory
        - name: dcmi
          hostPath:
            path: /usr/local/dcmi
        - name: ascend-driver-include
          hostPath:
            path: /usr/local/Ascend/driver/include
        - name: var-kubelet
          hostPath:
            path: /var/lib/kubelet