apiVersion: v1
kind: Namespace
metadata:
  name: cisco-hf
  labels:
    openshift.io/cluster-monitoring: "true"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cisco-hf-agents-sa
  namespace: cisco-hf
---
# ClusterRoleBinding for privileged access
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cisco-hf-agents-privileged
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:privileged
subjects:
- kind: ServiceAccount
  name: cisco-hf-agents-sa
  namespace: cisco-hf
---
# Persistent storage for agents
apiVersion: v1
kind: PersistentVolume
metadata:
  name: cisco-hf-agents-pv
  labels:
    type: local
spec:
  storageClassName: local-storage
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /opt/cisco/persistent-data
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cisco-hf-agents-pvc
  namespace: cisco-hf
spec:
  storageClassName: local-storage
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
# DaemonSet ensures HF agent runs on every UCS server node
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cisco-hf-agents
  namespace: cisco-hf
  labels:
    app: cisco_hf_agents
    component: hf_agents
spec:
  selector:
    matchLabels:
      app: cisco_hf_agents
  template:
    metadata:
      labels:
        app: cisco_hf_agents
    spec:
      serviceAccountName: cisco-hf-agents-sa
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: node-role.kubernetes.io/worker
                operator: Exists
      tolerations:
      - operator: Exists
      containers:
      - name: hf-agents
        image: public.ecr.aws/z9f4t0k6/hyperfabric/cisco_hf_agents:0.1.0-cbb2bc3bc2
        imagePullPolicy: Always
        resources:
          limits:
            memory: "2Gi"
            cpu: "2"
        securityContext:
          privileged: true
        volumeMounts:
        - name: os-release
          mountPath: /etc/os-release
          readOnly: true
        - name: run
          mountPath: /run
        - name: persistent-storage
          mountPath: /data-a/tortuga
      volumes:
      - name: os-release
        hostPath:
          path: /etc/os-release
      - name: dev
        hostPath:
          path: /dev
      - name: run
        emptyDir:
          medium: Memory
      - name: persistent-storage
        persistentVolumeClaim:
          claimName: cisco-hf-agents-pvc
      hostNetwork: true
      hostPID: true
      dnsPolicy: ClusterFirstWithHostNet
      restartPolicy: Always
