daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: quack
  namespace: quack
  labels:
    app: quack
spec:
  selector:
    matchLabels:
      app: quack
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      name: quack
      labels:
        app: quack
    spec:
      serviceAccountName: quack
      containers:
        - name: quack
          image: quay.io/pusher/quack:v0.1.0
          imagePullPolicy: Always
          args:
            - --tls-cert-file=/etc/certs/cert.pem
            - --tls-private-key-file=/etc/certs/key.pem
            - --audit-log-path=-
            - --audit-policy-file=/etc/config/audit.yaml
            - --v=2
          resources:
            requests:
              cpu: 10m
              memory: 20Mi
            limits:
              cpu: 100m
              memory: 100Mi
          livenessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: 443
            initialDelaySeconds: 10
          readinessProbe:
            httpGet:
              scheme: HTTPS
              path: /healthz
              port: 443
            initialDelaySeconds: 10
          volumeMounts:
          - name: certs
            mountPath: /etc/certs
            readOnly: true
          - name: config
            mountPath: /etc/config
            readOnly: true
      volumes:
      - name: certs
        secret:
          secretName: quack-certs
      - name: config
        configMap:
          name: quack-config
      tolerations:
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      nodeSelector:
        "node-role.kubernetes.io/master": "true"