{{- if eq .Values.sandbox.seccomp "localhost" }}
# Installs the strict allowlist seccomp profile onto every node so
# sandbox pods can run with seccompProfile type Localhost. The profile is
# the SAME file the Docker driver embeds (ci/check-helm.sh enforces the
# copies stay identical).
apiVersion: v1
kind: ConfigMap
metadata:
  name: teamclaw-seccomp-profile
  labels: {{- include "teamclaw.labels" . | nindent 4 }}
data:
  teamclaw-agent-profile.json: |-
{{ .Files.Get "files/agent-profile.json" | indent 4 }}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: teamclaw-seccomp-installer
  labels: {{- include "teamclaw.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: teamclaw-seccomp-installer
  template:
    metadata:
      labels:
        app.kubernetes.io/name: teamclaw-seccomp-installer
    spec:
      initContainers:
        - name: install
          image: busybox:1.36
          command:
            - sh
            - -c
            - cp /profile/teamclaw-agent-profile.json /host-seccomp/
          volumeMounts:
            - { name: profile, mountPath: /profile, readOnly: true }
            - { name: host-seccomp, mountPath: /host-seccomp }
      containers:
        - name: hold
          image: busybox:1.36
          command: ["sleep", "infinity"]
          resources:
            requests: { cpu: 5m, memory: 8Mi }
            limits: { cpu: 10m, memory: 16Mi }
      volumes:
        - name: profile
          configMap: { name: teamclaw-seccomp-profile }
        - name: host-seccomp
          hostPath:
            path: /var/lib/kubelet/seccomp
            type: DirectoryOrCreate
{{- end }}