deploy.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: getcaps

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: getcaps-sa
  namespace: getcaps

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: getcaps-read
  namespace: getcaps
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - list
  
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: getcaps-read
  namespace: getcaps
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: getcaps-read
subjects:
- kind: ServiceAccount
  name: getcaps-sa
  namespace: getcaps

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: getcaps-privileged-scc
  namespace: getcaps
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:privileged
subjects:
- kind: ServiceAccount
  name: getcaps-sa
  namespace: getcaps

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: getcaps
  namespace: getcaps
  labels:
    app: getcaps
spec:
  replicas: 1
  selector:
    matchLabels:
      app: getcaps
  template:
    metadata:
      labels:
        app: getcaps
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      serviceAccountName: getcaps-sa
      hostPID: true
      hostNetwork: true
      containers:
      - name: getcaps
        imagePullPolicy: Always
        image: quay.io/mavazque/getcriocaps:main
#        args:
#        - -n
#        - openshift-monitoring
#        - openshift-etcd
#        - -e
#        - -c
        securityContext:
          runAsUser: 0
        env:
          - name: CONTAINER_RUNTIME_ENDPOINT
            value: "unix:///run/crio/crio.sock"
        volumeMounts:
        - name: crio-sock
          mountPath: /run/crio/crio.sock
      volumes:
      - name: crio-sock
        hostPath:
          path: /run/crio/crio.sock
          type: Socket