# An ordinary pod on the same node as the analyst's workload pod, for the comparison that
# shows that pod ran in a Nitro sandbox. No runtimeClassName, so it runs as any pod does:
# it shares the node's kernel, reports the node's uptime, and sees the instance's own
# disks.
#
# <NAMESPACE>, <MANAGED_BY> and <NODE_NAME> are replaced at apply time. Pinning the node
# is the point: a reading from a pod on a different instance would compare nothing.
#
# Delete it by this exact name when you are done with it, never with a label selector:
#   kubectl delete pod ordinary-comparison -n <NAMESPACE>
apiVersion: v1
kind: Pod
metadata:
  name: ordinary-comparison
  namespace: <NAMESPACE>
  labels:
    app.kubernetes.io/managed-by: <MANAGED_BY>
spec:
  nodeName: <NODE_NAME>
  automountServiceAccountToken: false
  restartPolicy: Never
  containers:
    - name: shell
      image: public.ecr.aws/docker/library/busybox:1.37.0
      command: ["sleep", "600"]
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]