---
apiVersion: v1
kind: Pod
metadata:
  name: wireguard
  namespace: utils
  labels:
    app: wireguard
spec:
  containers:
  - name: wireguard
    image: ghcr.io/linuxserver/wireguard
    envFrom:
    - configMapRef:
        name: wireguard-configmap
    securityContext:
      capabilities:
        add:
        - NET_ADMIN
        - SYS_MODULE
      privileged: true
    volumeMounts:
    - name: wg-config
      mountPath: /config
    - name: host-volumes
      mountPath: /lib/modules
    ports:
    - containerPort: 51820
      protocol: UDP
    resources:
      requests:
        memory: "64Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "200m"
  volumes:
  - name: wg-config
    persistentVolumeClaim:
      claimName: pv-claim-wireguard
  - name: host-volumes
    hostPath:
      path: /lib/modules
      type: Directory
