1000-driver-container.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tigera-wireguard-kmod-driver-container
  namespace: tigera-wireguard-kmod
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tigera-wireguard-kmod-driver-container
  namespace: tigera-wireguard-kmod
rules:
- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  verbs:
  - use
  resourceNames:
  - privileged
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tigera-wireguard-kmod-driver-container
  namespace: tigera-wireguard-kmod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tigera-wireguard-kmod-driver-container
subjects:
- kind: ServiceAccount
  name: tigera-wireguard-kmod-driver-container
userNames:
- system:serviceaccount:tigera-wireguard-kmod:tigera-wireguard-kmod-driver-container
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tigera-wireguard-kmod-driver-container
  namespace: tigera-wireguard-kmod
spec:
  selector:
    matchLabels:
      app: tigera-wireguard-kmod-driver-container
  template:
    metadata:
      annotations:
        alpha.image.policy.openshift.io/resolve-names: '*'
      labels:
        app: tigera-wireguard-kmod-driver-container
    spec:
      serviceAccount: tigera-wireguard-kmod-driver-container
      serviceAccountName: tigera-wireguard-kmod-driver-container
      containers:
      - image: wireguard-kmod-driver-container:latest
        name: tigera-wireguard-kmod-driver-container
        imagePullPolicy: Always
        command: ["/sbin/init"]
        lifecycle:
          preStop:
            exec:
              command: ["/bin/sh", "-c", "systemctl stop kmods-via-containers@tigera-wireguard-kmod"]
        securityContext:
          privileged: true
      nodeSelector:
        node-role.kubernetes.io/worker: ""