apiVersion: v1
kind: Pod
metadata:
  labels:
    some-label: some-label-value
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: security
            operator: In
            values:
            - S1
        topologyKey: failure-domain.beta.kubernetes.io/zone
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: security
              operator: In
              values:
              - S2
          topologyKey: kubernetes.io/hostname
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
  containers:
  - name: busybox
    image: busybox
    resources:
      requests:
        example.com/dongle: 42
      limits:
        example.com/dongle: 42
    command:
    - cat
    tty: true
    env:
    - name: CONTAINER_ENV_VAR
      value: container-env-var-value
    volumeMounts:
    - mountPath: /container/data
      name: host-volume
    securityContext:
      runAsUser: 2000
      runAsGroup: 2000
  volumes:
  - name: empty-volume
    emptyDir: {}
  - name: host-volume
    hostPath:
      path: /host/data
