# A second pod that claims the same ReadWriteOncePod volume as ebs-sandbox. It is here to
# show the single-writer rule: while ebs-sandbox holds the claim, this pod stays Pending,
# because ReadWriteOncePod restricts the volume to one pod cluster-wide. Delete it after
# you have seen it Pending.
apiVersion: v1
kind: Pod
metadata:
  name: ebs-sandbox-second
  annotations:
    sandbox.amazonaws.com/network-isolated: "true"
    karpenter.sh/do-not-disrupt: "true"
spec:
  runtimeClassName: isolated-sandbox
  # The pod calls no Kubernetes API, so it mounts no ServiceAccount token.
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: writer
      image: public.ecr.aws/docker/library/busybox:1.37
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c", "echo second pod started; sleep 3600"]
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      volumeMounts:
        - name: data
          mountPath: /data
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: ebs-sandbox-data