> ## Documentation Index > Fetch the complete documentation index at: https://docs.idyl.network/llms.txt > Use this file to discover all available pages before exploring further. # DaemonSet > YAML manifest fields for IDYL DaemonSet resources. A DaemonSet keeps one pod running on every eligible node of its subnet. A node is eligible when it is admitted to the DaemonSet's subnet, belongs to the fleet the pod template's placement names (when it names one), is capacity the DaemonSet's account may run on, and advertises what the pod template needs. The pod count follows that set as nodes join and leave; the manifest states no replica count. Each pod is bound to its node for life: a failed pod is replaced on the same node and is never placed on another. ## Minimal manifest ```yaml theme={null} kind: DaemonSet metadata: name: node-agent subnet: "100000000001" spec: strategy: type: RollingUpdate template: spec: containers: - name: agent imageURI: ghcr.io/idyl-labs/example-agent:1.0.0 resources: requests: cpu: 250m memory: 256Mi ``` ## Example manifest ```yaml theme={null} kind: DaemonSet metadata: name: node-agent subnet: "100000000001" labels: app: node-agent spec: revisionHistoryLimit: 10 strategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 maxSurge: 0 template: metadata: labels: app: node-agent spec: restartPolicy: always placement: fleet: "391742608215" require: cuda: ">=13.0" containers: - name: agent imageURI: ghcr.io/idyl-labs/example-agent:1.0.0 imagePullPolicy: if_not_present env: - name: LOG_LEVEL value: info resources: requests: cpu: 250m memory: 256Mi limits: cpu: 500m memory: 512Mi ``` ## Field reference kind string Required Resource kind. The value is case-sensitive.Value `DaemonSet` metadata object Required Top-level workload metadata. metadata.namespace object Optional Namespace scope embedded in the manifest. Scoped SDK clients populate it when omitted and refuse a manifest that states a different scope.Format Explicit scope or SDK client scope metadata.namespace.accountId string Optional Account that owns the Namespace.Format 12-digit account ID metadata.namespace.namespace string Optional Namespace name within the Account. metadata.subnet string Optional Canonical subnet identifier where the workload should run.Format Explicit scope or SDK placement metadata.name string Required Stable workload name within the namespace. metadata.labels map\[string]string Optional User-defined labels for grouping, filtering, and ownership metadata. metadata.annotations map\[string]string Optional User-defined annotations for descriptive metadata that is not used for identity. spec object Required Desired DaemonSet configuration. spec.controller object Optional The resource that controls this DaemonSet. It is set only at creation, only by a caller the platform authorizes as that controller, and never changes afterwards; the platform never adopts a DaemonSet by matching its name or labels. spec.controller.kind string Required Kind of the controlling resource, as its lowercase resource kind token.Example `supervisor` spec.controller.id string Required ID of the controlling resource: the identity it keeps for its whole life.Format Canonical UUID spec.strategy object Required DaemonSet rollout strategy. spec.strategy.type string Required Rollout strategy type.Value `RollingUpdate` spec.strategy.rollingUpdate object Optional Rolling update controls. When omitted, the documented defaults of each control apply. spec.strategy.rollingUpdate.maxUnavailable integer Optional Maximum number of connected nodes that may be without a ready pod because of the update.Default `1` spec.strategy.rollingUpdate.maxSurge integer Optional Maximum number of nodes that may run the new pod beside the old one before the old one stops.Default `0` spec.revisionHistoryLimit integer Optional Number of prior DaemonSet revisions to retain.Default `10` spec.template object Required Pod template run on every eligible node. spec.template.metadata object Optional Metadata copied to pods created from this template. spec.template.metadata.labels map\[string]string Optional Labels copied to pods created from this template. spec.template.metadata.annotations map\[string]string Optional Annotations copied to pods created from this template. spec.template.spec object Required Pod spec used by this template. spec.template.spec.restartPolicy string Optional Container restart behavior. Possible enum values: spec.template.spec.platform string Optional Workload OS and architecture. If omitted, IDYL resolves the platform from policy and available capacity. Possible enum values: spec.template.spec.isolation object Optional Requested execution isolation boundary, with any settings the chosen class defines. If omitted, IDYL resolves isolation from subnet policy. Possible enum values: spec.template.spec.isolation.class string Required Requested execution isolation boundary. Possible enum values: spec.template.spec.isolation.microvm object Optional Settings only the microvm class defines. Accepted only when class is `microvm`; any other class is refused when this block is present. spec.template.spec.isolation.microvm.confidential boolean Optional Requests attested confidential execution. The workload is placed only on a runtime class advertising confidential execution, runs inside a hardware-attested confidential guest, and receives Vault material and Filesystem attachment credentials only after that attestation is verified. False, the zero value, requests none of this. spec.template.spec.network object Optional Workload network intent. If omitted, the server records class internet, whatever the isolation class. Possible enum values: spec.template.spec.network.class string Required Requested workload network policy. Required whenever the network block is present. A pod spec that omits the whole network block is admitted with class internet, whatever its isolation class. Possible enum values: spec.template.spec.network.egress object Optional Allowed outbound destinations for restricted-egress workloads.Format Restricted egress allow rules spec.template.spec.network.egress.allow array\[string] Optional Structured allow rules such as "dns" or "tcp:443:api.example.com". TCP targets must be DNS hostnames, not IP literals. Possible enum values: spec.template.spec.network.egress.denyLocalNetworks boolean Optional Must be true when network.egress.allow is set. Local networks remain denied while the listed destinations are allowed.Value `true` spec.template.spec.identity object Optional Managed workload identity intent. If omitted, managed identity applies. Possible enum values: default `managed` spec.template.spec.identity.mode string Required Managed workload identity mode. A present identity block must state the mode explicitly; omit the entire block to use the managed default. Possible enum values: spec.template.spec.gpu quantity string Optional Pod-level GPU requirement. GPU is a physical host device requirement, not a per-container resource. All containers in the pod share GPU access.Examples `h100`, `2:h100`, `nvidia:24Gi` spec.template.spec.require map\[string]string Optional Host capability requirements, for example `cuda: ">=13.0"`. The pod is scheduled only on nodes that satisfy every requirement.Format Exact version or `>=` minimum version spec.template.spec.placement object Optional Restricts scheduling to a fleet or a single node inside the workload's subnet. If omitted, the pod may run anywhere in the subnet.Format Exactly one of `fleet` or `node` spec.template.spec.placement.fleet string Optional Restricts scheduling to eligible members of this fleet.Format 12-digit fleet ID spec.template.spec.placement.node string Optional Restricts scheduling to exactly this node.Format Node ID spec.template.spec.containers array Required Containers that run in the pod.Requirement At least one container spec.template.spec.containers\[].name string Required Container name, unique within the pod. spec.template.spec.containers\[].imageURI string Required Container image reference, such as `nginx:latest`, `ubuntu:22.04`, or a private registry image. spec.template.spec.containers\[].imageDigest string Optional Optional image digest for verification, for example `sha256:abc123...`. When provided, it is appended to the registry image reference as `image@sha256:abc123`.Example `sha256:...` spec.template.spec.containers\[].imagePullPolicy string Optional When the runtime should pull the image. Possible enum values: spec.template.spec.containers\[].imagePullCredentialRef object Optional References a RegistryCredential in the workload namespace for image pulls. This type cannot carry a Vault Secret or TLSCertificate.Format `name` identifies a RegistryCredential spec.template.spec.containers\[].imagePullCredentialRef.name string Required RegistryCredential name in the workload namespace. spec.template.spec.containers\[].command array\[string] Optional Overrides the container image's ENTRYPOINT. If empty, the image's default ENTRYPOINT is used. If set without `args`, the image's default CMD is still used with the new entrypoint. spec.template.spec.containers\[].args array\[string] Optional Overrides the container image's CMD. If empty, the image's default CMD is used. spec.template.spec.containers\[].ports array Optional Named ports the container listens on. A stream addressed to a port's name is delivered by the Pod's own sidecar, authenticated, to 127.0.0.1:\. Declaring a port publishes nothing outside the Pod on its own. Names, and pairs of port number and protocol, are unique across all containers of the Pod. spec.template.spec.containers\[].ports\[].name string Required Name the port is addressed by, unique across all containers of the Pod.Format 1 to 15 characters: lowercase letters, digits, and `-`, with at least one letter and no leading, trailing, or consecutive `-` spec.template.spec.containers\[].ports\[].containerPort integer Required Port number the container listens on.Format 1 to 65535 spec.template.spec.containers\[].ports\[].protocol string Optional Transport protocol the container listens with. An absent protocol means TCP. Possible enum values: default `TCP` spec.template.spec.containers\[].env array Optional Environment variables to set in the container. spec.template.spec.containers\[].env\[].name string Required Environment variable name.Pattern `[a-zA-Z_][a-zA-Z0-9_]*` spec.template.spec.containers\[].env\[].value string Required Environment variable value. spec.template.spec.containers\[].volumeMounts array Optional Read-only provider-owned Vault projections exposed to this container. Only volumes declared in the enclosing PodSpec may be mounted. spec.template.spec.containers\[].volumeMounts\[].name string Required Declared Vault volume name. spec.template.spec.containers\[].volumeMounts\[].mountPath string Required Clean absolute destination inside this container. It may not overlap another Vault mount of the same container, and the system paths and the reserved /.idyl directory are refused. spec.template.spec.containers\[].volumeMounts\[].readOnly boolean Required Must be explicitly true.Value `true` spec.template.spec.containers\[].filesystemMounts array Optional Filesystems attached to this container at the declared destinations. A declaration confers no authority: the platform authorizes each mount before the Pod starts, and a node attaches it only when its runtime class advertises Filesystem attachment, whatever the isolation class. spec.template.spec.containers\[].filesystemMounts\[].filesystem object Required Filesystem selects one authorized tree in the Workload's Namespace and Subnet. spec.template.spec.containers\[].filesystemMounts\[].filesystem.name string Optional Name selects the Filesystem within the Workload's Namespace and Subnet; omit ID.Required when ID is absent spec.template.spec.containers\[].filesystemMounts\[].filesystem.id string Optional ID pins a stable Filesystem identity instead of a reusable name; omit Name.Required when Name is absent spec.template.spec.containers\[].filesystemMounts\[].mountPath string Required MountPath is a clean absolute container path outside reserved and overlapping mounts. spec.template.spec.containers\[].filesystemMounts\[].readOnly boolean Required ReadOnly true opens saved files; false makes this Pod the Filesystem's one writer. spec.template.spec.containers\[].filesystemMounts\[].version string Optional Version selects latest, a saved number or name on read-only mounts. Omitted means latest.Default `latest` on read-only mounts spec.template.spec.containers\[].filesystemMounts\[].saveEvery string Optional SaveEvery requests a positive periodic save interval on a writable mount; nil disables periodic saves. spec.template.spec.containers\[].readinessProbe object Optional Probe that decides when the container is ready. A container that declares one starts not ready and is ready while it is running and its probe has met its success threshold; a container that declares none is ready while it is running. Absent means no probe, never an empty one. spec.template.spec.containers\[].readinessProbe.exec object Required Command run inside the container. A probe states exactly one kind, and exec is the only kind. spec.template.spec.containers\[].readinessProbe.exec.command array\[string] Required Executable and its arguments. The first element names the executable and must not be empty; later elements may be empty strings. No element may contain a NUL byte.Requirement At least one element spec.template.spec.containers\[].readinessProbe.periodSeconds integer Optional Seconds between the end of one probe run and the start of the next.Format Whole seconds, 1 to 300 (default 10) spec.template.spec.containers\[].readinessProbe.timeoutSeconds integer Optional Seconds one probe run may take, counted from the moment the command starts. A run still going when it expires is stopped, with every process it started, and counts as a failure. The effective timeout may not exceed the effective periodSeconds.Format Whole seconds, 1 to 60 (default 1) spec.template.spec.containers\[].readinessProbe.successThreshold integer Optional Consecutive successful runs that make a not-ready container ready.Format 1 to 10 (default 1) spec.template.spec.containers\[].readinessProbe.failureThreshold integer Optional Consecutive failed runs that make a ready container not ready.Format 1 to 10 (default 3) spec.template.spec.containers\[].resources object Optional Container resource requests and limits.Requirement CPU or memory must be set on at least one container spec.template.spec.containers\[].resources.requests object Optional Resources used for scheduling. If a request is omitted but a limit is set for that resource, the limit is used as the effective request. spec.template.spec.containers\[].resources.requests.cpu quantity string Optional CPU quantity for this resource entry.Examples `500m`, `0.5`, `1` spec.template.spec.containers\[].resources.requests.memory quantity string Optional Memory quantity for this resource entry.Examples `256Mi`, `1Gi` spec.template.spec.containers\[].resources.requests.disk quantity string Optional Disk quantity for this resource entry.Examples `1Gi`, `10G` spec.template.spec.containers\[].resources.limits object Optional Maximum resources allowed for the container. spec.template.spec.containers\[].resources.limits.cpu quantity string Optional CPU quantity for this resource entry.Examples `500m`, `0.5`, `1` spec.template.spec.containers\[].resources.limits.memory quantity string Optional Memory quantity for this resource entry.Examples `256Mi`, `1Gi` spec.template.spec.containers\[].resources.limits.disk quantity string Optional Disk quantity for this resource entry.Examples `1Gi`, `10G` spec.template.spec.volumes array Optional Closed provider-owned Vault projection sources. A volume represents exactly one Secret or TLSCertificate; arbitrary host storage cannot be represented. spec.template.spec.volumes\[].name string Required Volume name referenced by container volume mounts. spec.template.spec.volumes\[].secret object Optional Secret source.Format Exactly one of `secret` or `certificate` spec.template.spec.volumes\[].secret.secretRef object Required Typed Secret resource reference. spec.template.spec.volumes\[].secret.secretRef.name string Required Secret resource name. spec.template.spec.volumes\[].secret.secretRef.namespace string Optional Resource namespace. Omit to use the workload namespace.Format Must equal the workload namespace in v1 spec.template.spec.volumes\[].secret.secretRef.version integer Optional Immutable Secret version. Omit to bind current on first resolution.Format Positive integer spec.template.spec.volumes\[].secret.items array Optional Optional key-to-path selection. Omit to project every key by key name. spec.template.spec.volumes\[].secret.items\[].key string Required Secret data key to project. spec.template.spec.volumes\[].secret.items\[].path string Required Clean relative destination path within the volume. spec.template.spec.volumes\[].certificate object Optional TLSCertificate source.Format Exactly one of `secret` or `certificate` spec.template.spec.volumes\[].certificate.certificateRef object Required Typed TLSCertificate resource reference. spec.template.spec.volumes\[].certificate.certificateRef.name string Required TLSCertificate resource name. spec.template.spec.volumes\[].certificate.certificateRef.namespace string Optional Resource namespace. Omit to use the workload namespace.Format Must equal the workload namespace in v1 spec.template.spec.volumes\[].certificate.certificateRef.version integer Optional Immutable TLSCertificate version. Omit to bind current on first resolution.Format Positive integer spec.template.spec.sharedVolumeSize quantity string Optional Size of the shared volume mounted for the pod.Examples `1Gi`, `10Gi` spec.template.spec.terminationGracePeriodSeconds integer Optional How long the node waits after sending SIGTERM before issuing SIGKILL when stopping the pod's containers. If omitted, the 30-second default applies. A value of 0 requests an immediate SIGKILL with no graceful period.Format Whole seconds, >= 0 (default 30) ## Read-only fields IDYL can return these fields when you inspect a workload. Do not include them in authored manifests. | Field | Description | | - | - | | `metadata.id` | IDYL-assigned resource ID. | | `metadata.namespace.id` | IDYL-assigned namespace ID. | | `metadata.ownerReferences` | Parent workload relationship, such as a ReplicaSet owned by a Deployment. | | `metadata.createdAt` | Creation timestamp. | | `metadata.updatedAt` | Last update timestamp. | | `metadata.deletedAt` | Deletion timestamp, when present. | | `metadata.revision` | Revision information returned by IDYL. | | `status` | Current observed state returned by IDYL. | ## Validation notes * `kind` values are case-sensitive. * At least one container is required in every pod spec. * At least one container must specify CPU or memory in `resources.requests` or `resources.limits`, unless the CLI fills those values from configured defaults before sending the workload. * GPU requirements belong at the pod spec `gpu` path, not under per-container resources. * Environment variable names must be unique within a container and must match `[a-zA-Z_][a-zA-Z0-9_]*`. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.