apiVersion: apps/v1
kind: Deployment
metadata:
  name: wireguard-vpn
  namespace: wireguard
spec:
  selector:
    matchLabels:
      app: wireguard-vpn
  template:
    metadata:
      labels:
        app: wireguard-vpn
    spec:
      hostNetwork: true
      containers:
      - image: eu.gcr.io/gardener-project/test/wireguard:0.4
        name: wireguard-vpn
        command:
        - /wireguard
        volumeMounts:
        - name: wireguard-secret
          mountPath: /etc/wireguard
        securityContext:
#          privileged: true
          capabilities:
            add: 
            - CAP_NET_ADMIN
      volumes:
      - name: wireguard-secret
        secret:
          defaultMode: 0400
          secretName: wireguard-secret
