dotfiles/infrastructure/base/openwrt/pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: openwrt
  annotations:
    # Setting spec.force to true will make Flux recreate the Pod when any
    # immutable field is changed, forcing the Pod to run every time the
    # container image tag changes.
    kustomize.toolkit.fluxcd.io/force: enabled
spec:
  restartPolicy: Never
  automountServiceAccountToken: false
  containers:
  - image: harbor.home.wugi.info/openwrt/rootfs:latest
    name: openwrt
    command:
    - /bin/sleep
    - infinity

    # - /bin/sh
    # - -c
    # - |
    #   set -o nounset -o errexit -o pipefail -o xtrace
    #   while [ -e /continue ]
    #   do
    #       sleep 5
    #   done
    #   network_namespace=$(printf ip-netns-%s $(tr -dc A-Za-z0-9 </dev/urandom | head -c 12))
    #   ip netns add $network_namespace
    #   network_interface=$(printf macvlan%s $(tr -dc A-Za-z0-9 </dev/urandom | head -c 8))
    #   ip link add $network_interface link $SOURCE_NETWORK_INTERFACE_NAME type macvlan mode bridge
    #   ip link set $network_interface netns $network_namespace
    #   ip netns exec $network_namespace ip link set dev $network_interface name eth0
    #   ip netns exec $network_namespace ip link set eth0 up
    #   ip netns exec $network_namespace ip addr add $TARGET_NETWORK_INTERFACE_IP_ADDRESS dev eth0
    #   ip netns exec $network_namespace ip route add default via $TARGET_NETWORK_INTERFACE_GATEWAY dev eth0
    #   # XXX: Delete ping after fixing network availability without egress traffic from pod.
    #   ip netns exec $network_namespace ping -c1 $TARGET_NETWORK_INTERFACE_GATEWAY || true
    #   exec ip netns exec $network_namespace /sbin/init
    env:
    - name: SOURCE_NETWORK_INTERFACE_NAME
      value: eth0
    - name: TARGET_NETWORK_INTERFACE_IP_ADDRESS
      value: 192.168.0.148/24
    - name: TARGET_NETWORK_INTERFACE_GATEWAY
      value: 192.168.0.1
    ports:
    - containerPort: 80
      name: http
      protocol: TCP
    resources:
      limits:
        cpu: 2000m
        memory: 4096Mi
      requests:
        cpu: 100m
        memory: 512Mi
    securityContext:
      capabilities:
        add:
        - NET_ADMIN
        - NET_BIND_SERVICE
        - NET_RAW
        - SYS_ADMIN
    tty: true
    volumeMounts:
    - mountPath: /run
      name: run
    - mountPath: /tmp
      name: tmp
  volumes:
  - emptyDir:
      medium: Memory
      sizeLimit: 512M
    name: run
  - emptyDir:
      medium: Memory
      sizeLimit: 2G
    name: tmp