# Keeps the side-loaded runner image alive on every node.
#
# kubelet's image garbage collector deletes UNUSED images once the image
# filesystem crosses imageGCHighThresholdPercent (85% by default). debian3 runs
# at 86-90%, so the collector fires every few minutes and has already deleted
# this exact image once:
#
#   image_gc_manager.go:529] "Removing image to free bytes"
#     imageID="sha256:f6d7bca4..." size=2385230046
#
# With `imagePullPolicy: Never` there is no recovery from that: the next runner
# pod scheduled onto the node goes ErrImageNeverPull and the job queues forever.
# image/distribute.sh repairs a missing node, but it cannot outrun a collector
# that re-runs every five minutes.
#
# kubelet never collects an image that a running container uses, so one idle
# pod per node holding this image is what actually makes the side-load durable.
# The pod is also the detector: on a node that lost the image it cannot start,
# so `kubectl -n arc-ci get ds runner-image-pin` shows the wedge before a CI job
# ever hits it.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: runner-image-pin
  namespace: arc-ci
  labels:
    app.kubernetes.io/name: runner-image-pin
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: runner-image-pin
  template:
    metadata:
      labels:
        app.kubernetes.io/name: runner-image-pin
    spec:
      serviceAccountName: arc-runner
      automountServiceAccountToken: false
      # The node this pins is more useful than the pod: tolerate taints so a
      # control-plane or otherwise-tainted node is pinned too. debian3 is the
      # k3s server and the node that actually loses images.
      tolerations:
        - operator: Exists
      terminationGracePeriodSeconds: 1
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: pin
          # MUST stay byte-identical to arc/runner-values.yaml and
          # image/build.sh -- pinning a different tag pins the wrong image.
          # modules/ci/tests/runner-image.test.sh enforces the three-way match.
          image: localhost/overdeck-ci-runner:arc-pr-gate-v1
          imagePullPolicy: Never
          command: ["/bin/sleep", "infinity"]
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              cpu: 50m
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
