apiVersion: v1
kind: Namespace
metadata:
  name: nydus-system

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nydus-snapshotter-sa
  namespace: nydus-system

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nydus-snapshotter-role
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nydus-snapshotter-role-binding
roleRef:
  kind: ClusterRole
  name: nydus-snapshotter-role
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: nydus-snapshotter-sa
    namespace: nydus-system

---
apiVersion: v1
kind: Pod
metadata:
  name: nydus-snapshotter
  namespace: nydus-system
spec:
  containers:
    - name: nydus-snapshotter
      image: local-dev:e2e
      imagePullPolicy: IfNotPresent
      args:
        - containerd-nydus-grpc
        - --nydusd /usr/local/bin/nydusd
        - --nydusd-config /etc/nydus/nydusd.json
        - --config /etc/nydus/config.toml
        - --log-level debug
        - --daemon-mode shared
        - --log-to-stdout
      securityContext:
        privileged: true
      volumeMounts:
        - mountPath: /etc/nydus/
          name: nydus-all-config
        - mountPath: /var/lib/containerd-nydus
          mountPropagation: Bidirectional
          name: nydus-lib
        - mountPath: /run/containerd-nydus
          mountPropagation: Bidirectional
          name: nydus-run
        - mountPath: /dev/fuse
          name: fuse
        - mountPath: /etc/containerd/config.toml
          name: containerd-conf
  hostNetwork: true
  hostPID: true
  serviceAccountName: nydus-snapshotter-sa
  volumes:
    - name: nydus-all-config
      projected:
        sources:
          - configMap:
              name: nydusd-config
          - configMap:
              name: snapshotter-config
    - hostPath:
        path: /run/containerd-nydus
        type: DirectoryOrCreate
      name: nydus-run
    - hostPath:
        path: /var/lib/containerd-nydus
        type: DirectoryOrCreate
      name: nydus-lib
    - hostPath:
        path: /dev/fuse
      name: fuse
    - hostPath:
        path: /etc/containerd/config.toml
        type: ""
      name: containerd-conf
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nydusd-config
  namespace: nydus-system
data:
  nydusd.json: |-
    {
      "device": {
        "backend": {
          "type": "registry",
          "config": {
            "scheme": "",
            "skip_verify": true,
            "timeout": 10,
            "connect_timeout": 10,
            "retry_limit": 2
          }
        },
        "cache": {
          "type": "blobcache",
          "config": {
            "work_dir": "/var/lib/nydus/cache/"
          }
        }
      },
      "mode": "direct",
      "digest_validate": false,
      "iostats_files": false,
      "enable_xattr": true,
      "fs_prefetch": {
        "enable": true,
        "threads_count": 10,
        "merging_size": 131072,
        "bandwidth_rate": 1048576
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: snapshotter-config
  namespace: nydus-system
data:
  config.toml: |-
    version = 1
    root = "/var/lib/containerd-nydus"
    address = "/run/containerd-nydus/containerd-nydus-grpc.sock"
    daemon_mode = "multiple"
    enable_system_controller = true
    # Enable by assigning an address, empty indicates metrics server is disabled
    metrics_address = ":9110"
    # Whether tp enable stargz support
    enable_stargz = false
    # Whether snapshotter should try to clean up resources when it is closed
    cleanup_on_close = false

    [daemon]
    nydusd_path = "/usr/local/bin/nydusd"
    nydusimage_path = "/usr/local/bin/nydus-image"
    # fusedev or fscache
    fs_driver = "fusedev"
    # Specify nydusd log level
    log_level = "info"
    # How to process when daemon dies: "none", "restart" or "failover"
    recover_policy = "restart"
    # Specify a configuration file for nydusd
    nydusd_config = "/etc/nydus/nydusd.json"
    # The fuse or fscache IO working threads started by nydusd
    threads_number = 4

    [log]
    # Snapshotter's log level
    level = "info"
    log_rotation_compress = true
    log_rotation_local_time = true
    # Max number of days to retain logs
    log_rotation_max_age = 7
    log_rotation_max_backups = 5
    # In unit MB(megabytes)
    log_rotation_max_size = 1
    log_to_stdout = false

    [remote]
    convert_vpc_registry = false

    [remote.auth]
    # Fetch the private registry auth by listening to K8s API server
    enable_kubeconfig_keychain = true
    # synchronize `kubernetes.io/dockerconfigjson` secret from kubernetes API server with specified kubeconfig (default `$KUBECONFIG` or `~/.kube/config`)
    kubeconfig_path = ""
    # Fetch the private registry auth as CRI image service proxy
    enable_cri_keychain = false
    # the target image service when using image proxy
    image_service_address = ""

    [snapshot]
    enable_nydus_overlayfs = false
    # Whether to remove resources when a snapshot is removed
    sync_remove = false

    [cache_manager]
    disable = false
    gc_period = "24h"
    cache_dir = ""

    [image]
    public_key_file = ""
    validate_signature = false
