apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: operator
  labels:
    component: operator
spec:
  selector:
    matchLabels:
      component: operator
  template:
    metadata:
      labels:
        component: operator
    spec:
      containers:
      - name: operator
        image: gcr.io/PROJECT_ID/wireguard-operator:latest
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            cpu: 10m
            memory: 64m
        securityContext:
          capabilities:
            add: ["NET_ADMIN"]
          # Can we run without this?
          allowPrivilegeEscalation: true
      hostNetwork: true
      volumes:
        - name: dev-tun
          hostPath:
            path: /dev/net/tun
