mirror of
https://github.com/intel/intel-device-plugins-for-kubernetes.git
synced 2025-06-03 03:59:37 +00:00
df7492d763
We had securityContext specified twice and the latter was overwriting readOnlyRootFilesystem=true. With this commit, the container is properly mounted readonly. However, we need a tmpfs for DPDK runtime data so an emptyDir volume is added (NB: see kubernetes/issues/48912 for discussion on emptyDir mount options). Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
41 lines
915 B
YAML
41 lines
915 B
YAML
kind: Pod
|
|
apiVersion: v1
|
|
metadata:
|
|
name: qat-dpdk
|
|
spec:
|
|
containers:
|
|
- name: crypto-perf
|
|
image: intel/crypto-perf:devel
|
|
imagePullPolicy: IfNotPresent
|
|
command: [ "/bin/bash", "-c", "--" ]
|
|
args: [ "while true; do sleep 300000; done;" ]
|
|
volumeMounts:
|
|
- mountPath: /dev/hugepages
|
|
name: hugepage
|
|
- mountPath: /var/run/dpdk
|
|
name: dpdk-runtime
|
|
resources:
|
|
requests:
|
|
cpu: "3"
|
|
memory: "128Mi"
|
|
qat.intel.com/generic: '4'
|
|
hugepages-2Mi: "128Mi"
|
|
limits:
|
|
cpu: "3"
|
|
memory: "128Mi"
|
|
qat.intel.com/generic: '4'
|
|
hugepages-2Mi: "128Mi"
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
add:
|
|
["IPC_LOCK", "SYS_ADMIN"]
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: dpdk-runtime
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: hugepage
|
|
emptyDir:
|
|
medium: HugePages
|