daemonset.yml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: selinux-demo
  labels:
    k8s-app: selinux-demo
spec:
  selector:
    matchLabels:
      name: selinux-demo
  template:
    metadata:
      labels:
        name: selinux-demo 
    spec:
      hostNetwork: true
      nodeSelector:
        node-role.kubernetes.io/control-plane: "true"
      tolerations:
      # these tolerations are to have the daemonset runnable on control plane nodes
      # remove them if your control plane nodes should not run pods
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule
      containers:
      - name: weird-nginx
        image: nginx 
        securityContext:
          allowPrivilegeEscalation: true 
          runAsUser: 0
      #    seLinuxOptions:
      #      type: testselinux_t.process
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: varlog
          mountPath: /srv
        - name: nginx-cm
          mountPath: /etc/nginx/
      terminationGracePeriodSeconds: 30
      volumes:
      - name: varlog
        hostPath:
          path: /var/log/
      - name: nginx-cm
        configMap:
          name: selinux-demo