# Copyright 2026 NVIDIA CORPORATION
# SPDX-License-Identifier: Apache-2.0
#
# DaemonSet placement is intentional: scenarios 1 and 3 select pods by node and
# require exactly one NRI-injected demo workload pod on every GPU worker.
# The demo workload has no mock volume, mock environment variables, GPU request,
# or RuntimeClass. containerd's NRI plugin supplies the mock overlay, topology
# identity, and the annotated IMEX channel device nodes.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: compute-domain-demo-workload
  labels:
    app.kubernetes.io/name: compute-domain-demo-workload
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: compute-domain-demo-workload
  template:
    metadata:
      labels:
        app.kubernetes.io/name: compute-domain-demo-workload
      annotations:
        nvml-mock.nvidia.com/imex-channels: "true"
    spec:
      automountServiceAccountToken: false
      nodeSelector:
        nvidia.com/gpu.present: "true"
      containers:
        - name: demo-workload
          image: nvml-mock:compute-domain-workload
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-c", "trap : TERM INT; sleep infinity & wait"]
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 128Mi
---
# The real IMEX daemons listen on both the peer and command/status ports. A
# podSelector-only peer is namespace-local, so only other pods from this
# demo workload in compute-domain-workload can connect. Selecting Ingress alone
# intentionally leaves all egress unrestricted.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: compute-domain-demo-workload
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: compute-domain-demo-workload
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: compute-domain-demo-workload
      ports:
        - port: 50000
          protocol: TCP
        - port: 50005
          protocol: TCP