apiVersion: v1
kind: Pod
metadata:
  name: apiserver-proxy
  namespace: kube-system
  labels:
    name: apiserver-proxy
spec:
  automountServiceAccountToken: false
  priorityClassName: system-node-critical
  hostNetwork: true
  dnsPolicy: Default  # Don't use cluster DNS.
  tolerations:
  - key: "CriticalAddonsOnly"
    operator: "Exists"
  containers:
  - name: apiserver-proxy
    image: bazel/cmd/apiserver-proxy-sidecar:go_image
    imagePullPolicy: IfNotPresent
    env:
    - name: KUBERNETES_SERVICE_HOST
      value: 10.96.0.2
    command:
    - /app/cmd/apiserver-proxy-sidecar/go_image.binary
    - --interface=apisrv0
    - --v=2
    - --cleanup=true
    securityContext:
      privileged: true
    resources:
      limits:
        memory: "128Mi"
        cpu: "500m"
    volumeMounts:
    - mountPath: /run/xtables.lock
      name: xtables-lock
      readOnly: false
  volumes:
  - name: xtables-lock
    hostPath:
      path: /run/xtables.lock
      type: FileOrCreate
