---
# VENDORED, MACHINE-GENERATED, from intel/intel-device-plugins-for-kubernetes @ v0.37.0:
#   deployments/gpu_plugin/base
#
# RE-VENDOR on a version bump (and bump `newTag` in kustomization.yaml to match):
#   kubectl kustomize \
#     "https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/base?ref=vX.Y.Z" \
#     > platform/intel-gpu-plugin/intel-gpu-plugin.yaml
#   # then re-add this header, and READ THE DIFF — upstream has changed the securityContext
#   # and the volume set between minor releases before.
#
# Generated 2026-10-01 at v0.37.0; sha256 of the body below (header excluded):
#   80ebd070f983f3116f4004f719d9c872220997ec766b4ab7e7290585ac8ef842
# The raw upstream source file reviewed to produce it
# (deployments/gpu_plugin/base/intel-gpu-plugin.yaml) was sha256
#   c8773918c2370e711d4ba84120a9971a290bf75ecf81dc520782bcccd7ef24b6
# and the two were proven EQUIVALENT, not merely similar: `yq -P 'sort_keys(..)'` of each diffs
# clean, so passing it through kustomize changed formatting only and no content.
#
# WHY GENERATED RATHER THAN A BYTE COPY of the upstream file: upstream mixes YAML sequence
# indentation styles within the one document (`containers:` non-indented, `env:` indented), and
# ci/yamllint.yaml sets `indentation: indent-sequences: consistent`, so a verbatim copy is a hard
# lint ERROR and blocks the merge gate — measured, this file failed exactly that way first time
# round. `kubectl kustomize` normalises the output, which is also precisely the re-vendor idiom
# platform/external-snapshotter documents for the same reason.
#
# WHY VENDORED AT ALL rather than a remote kustomize base (`...gpu_plugin/base?ref=v0.37.0` left in
# `resources:`): the same reason platform/external-snapshotter is vendored. A remote base is
# `git fetch`ed by Flux's kustomize-controller on EVERY reconcile, those fetches intermittently
# exceeded the controller's 27s timeout, and a transient GitHub slowness then rendered as
# "kustomize build failed" on the whole tier. A local file makes the build OFFLINE and
# deterministic — which also means `kustomize build` in the CI gate proves the real thing instead
# of proving GitHub was up. (platform/kubevirt still carries the remote-base pattern and its latent
# fragility; not this component's problem.)
#
# DO NOT HAND-EDIT THE BODY. Every local change belongs in kustomization.yaml as a transformer or
# patch, so the next re-vendor stays a mechanical regenerate-and-diff instead of a three-way merge.
# The image tag below is re-pinned (and fully qualified) by the `images:` transformer there. The
# rationale for each thing deliberately NOT changed — no privileged, no supplementalGroups, no
# -shared-dev-num, no NFD overlay, no health-management — is in README.md.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: intel-gpu-plugin
  name: intel-gpu-plugin
spec:
  selector:
    matchLabels:
      app: intel-gpu-plugin
  template:
    metadata:
      labels:
        app: intel-gpu-plugin
    spec:
      containers:
      - env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        image: intel/intel-gpu-plugin:0.37.1
        imagePullPolicy: IfNotPresent
        name: intel-gpu-plugin
        resources:
          limits:
            cpu: 100m
            memory: 115Mi
          requests:
            cpu: 40m
            memory: 45Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          seLinuxOptions:
            type: container_device_plugin_t
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
        - mountPath: /dev/dri
          name: devfs
          readOnly: true
        - mountPath: /sys/class/drm
          name: sysfsdrm
          readOnly: true
        - mountPath: /var/lib/kubelet/device-plugins
          name: kubeletsockets
        - mountPath: /var/run/cdi
          name: cdipath
      nodeSelector:
        kubernetes.io/arch: amd64
      volumes:
      - hostPath:
          path: /dev/dri
        name: devfs
      - hostPath:
          path: /sys/class/drm
        name: sysfsdrm
      - hostPath:
          path: /var/lib/kubelet/device-plugins
        name: kubeletsockets
      - hostPath:
          path: /var/run/cdi
          type: DirectoryOrCreate
        name: cdipath
  updateStrategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate