kind: Pod
apiVersion: v1
metadata:
  namespace: ${ cr.namespace() }
  name: ${ cr.name() }
  labels:
    app.kubernetes.io/name: ${ constants.APP_NAME }
    app.kubernetes.io/instance: ${ cr.name() }
    app.kubernetes.io/component: ${ constants.APP_NAME }
    app.kubernetes.io/managed-by: ${ constants.VM_OP_NAME }
  annotations:
    # Triggers update of config map mounted in pod
    # See https://ahmet.im/blog/kubernetes-secret-volumes-delay/
    vmrunner.jdrupes.org/cmVersion: "${ configMapResourceVersion }"
    vmoperator.jdrupes.org/version: ${ managerVersion }
  ownerReferences:
  - apiVersion: ${ cr.apiVersion() }
    kind: ${ constants.Crd.KIND_VM }
    name: ${ cr.name() }
    uid: ${ cr.metadata().getUid() }
    blockOwnerDeletion: true
    controller: false
<#assign spec = cr.spec() />
spec:
  containers:
  - name: ${ cr.name() }
    <#assign image = spec.image>
    <#if image.source??>
    image: ${ image.source }
    <#else>
    image: ${ image.repository }/${ image.path }<#if image.version??>:${ image.version }</#if>
    </#if>
    <#if image.pullPolicy??>
    imagePullPolicy: ${ image.pullPolicy }
    </#if>
    <#if spec.vm.display.spice??>
    ports:
      <#if spec.vm.display.spice??>
      - name: spice
        containerPort: ${ spec.vm.display.spice.port?c }
        protocol: TCP
      </#if>
    </#if>
    volumeMounts:
    # Not needed because pod is priviledged:
    # - mountPath: /dev/kvm
    #   name: dev-kvm
    # - mountPath: /dev/net/tun
    #   name: dev-tun
    # - mountPath: /sys/fs/cgroup
    #   name: cgroup
    - name: config
      mountPath: /etc/opt/vmrunner
    - name: runner-data
      mountPath: /var/local/vm-data
    - name: vmop-image-repository
      mountPath: ${ constants.IMAGE_REPO_PATH }
    volumeDevices:
    <#list spec.vm.disks as disk>
    <#if disk.volumeClaimTemplate??>
    - name: ${ disk.generatedDiskName }
      devicePath: /dev/${ disk.generatedDiskName }
    </#if>
    </#list>
    securityContext:
      privileged: true
    <#if spec.resources??>
    resources: ${ toJson(spec.resources) }
    <#else>
    <#if spec.vm.currentCpus?? || spec.vm.currentRam?? >
    resources:
      requests:
        <#if spec.vm.currentCpus?? >
        <#assign factor = 2.0 />
        <#if reconciler.cpuOvercommit??>
        <#assign factor = reconciler.cpuOvercommit * 1.0 />
        </#if>
        cpu: ${ (parseQuantity(spec.vm.currentCpus) / factor)?c }
        </#if>
        <#if spec.vm.currentRam?? >
        <#assign factor = 1.25 />
        <#if reconciler.ramOvercommit??>
        <#assign factor = reconciler.ramOvercommit * 1.0 />
        </#if>
        memory: ${ (parseQuantity(spec.vm.currentRam) / factor)?floor?c }
        </#if>
    </#if>
    </#if>
  volumes:
  # Not needed because pod is priviledged:
  # - name: dev-kvm
  #   hostPath:
  #     path: /dev/kvm
  #     type: CharDevice
  # - hostPath:
  #     path: /dev/net/tun
  #     type: CharDevice
  #   name: dev-tun
  # - name: cgroup
  #   hostPath:
  #     path: /sys/fs/cgroup
  - name: config
    projected:
      sources:
      - configMap:
          name: ${ cr.name() }
      <#if displaySecret??>
      - secret:
          name: ${ displaySecret }
      </#if>
  - name: vmop-image-repository
    persistentVolumeClaim:
      claimName: vmop-image-repository
  - name: runner-data
    persistentVolumeClaim:
      claimName: ${ runnerDataPvcName }
  <#list spec.vm.disks as disk>
  <#if disk.volumeClaimTemplate??>
  - name: ${ disk.generatedDiskName }
    persistentVolumeClaim:
      claimName: ${ disk.generatedPvcName }
  </#if>
  </#list>
  hostNetwork: true
  terminationGracePeriodSeconds: ${ (spec.vm.powerdownTimeout + 5)?c }
  <#if spec.nodeName??>
  nodeName: ${ spec.nodeName }
  </#if>
  <#if spec.nodeSelector??>
  nodeSelector: ${ toJson(spec.nodeSelector) }
  </#if>
  <#if spec.affinity??>
  affinity: ${ toJson(spec.affinity) }
  </#if>
  serviceAccountName: vm-runner
