instruction: Create a Kubernetes Pod configuration with best practices
output: ```dockerfile
  from Kubernetes, as well as the associated
  storage asset in the external infrastructure. Volumes that were dynamically provisioned
  inherit the reclaim policy of their StorageClass, which
  defaults to Delete. The administrator should configure the StorageClass
  according to users' expectations; otherwise, the PV must be edited or
  patched after it is created. See
  Change the Reclaim Policy of a PersistentVolume.RecycleWarning:The Recycle reclaim policy is deprecated. Instead, the recommended approach
  is to use dynamic provisioning.If supported by the underlying volume plugin, the Recycle reclaim policy performs
  a basic scrub (rm -rf /thevolume/*) on the volume and makes it available again for a new claim.However, an administrator can configure a custom recycler Pod template using
  the Kubernetes controller manager command line arguments as described in the
  reference.
  The custom recycler Pod template must contain a volumes specification, as
  shown in the example below:apiVersion: v1
  kind: Pod
  metadata:
   name: pv-recycler
   namespace: default
  spec:
   restartPolicy: Never
   volumes:
   - name: vol
   hostPath:
   path: /any/path/it/will/be/replaced
   containers:
   - name: pv-recycler
   image: "registry.k8s.io/busybox"
   command: ["/bin/sh", "-c", "test -e /scrub && rm -rf /scrub/..?* /scrub/.[!.]* /scrub/* && test -z \"$(ls -A /scrub)\" || exit 1"]
   volumeMounts:
   - name: vol
   mountPath: /scrub
  However, the particular path specified in the custom recycler Pod template in the
  volumes part is replaced with the particular path of the volume that is being recycled.PersistentVolume deletion protection finalizerFEATURE STATE:
  Kubernetes v1.33 [stable] (enabled by default: true)Finalizers can be added on a PersistentVolume to ensure that PersistentVolumes
  having Delete reclaim policy are deleted only after the backing storage are deleted.The finalizer external-provisioner.volume.kubernetes.io/finalizer(introduced
  in v1.31) is added to both dynamically provisioned and statically provisioned
  CSI volumes.The finalizer kubernetes.io/pv-controller(introduced in v1.31) is added to
  dynamically provisioned in-tree plugin volumes and skipped for statically
  provisioned in-tree plugin volumes.The following is an example of dynamically provisioned in-tree plugin volume:kubectl describe pv pvc-74a498d6-3929-47e8-8c02-078c1ece4d78
  Name: pvc-74a498d6-3929-47e8-8c02-078c1ece4d78
  Labels: <none>
  Annotations: kubernetes.io/createdby: vsphere-volume-dynamic-provisioner
   pv.kubernetes.io/bound-by-controller: yes
   pv.kubernetes.io/provisioned-by: kubernetes.io/vsphere-volume
  Finalizers: [kubernetes.io/pv-protection kubernetes.io/pv-controller]
  StorageClass: vcp-sc
  Status: Bound
  Claim: default/vcp-pvc-1
  Reclaim Policy: Delete
  Access Modes: RWO
  VolumeMode: Filesystem
  Capacity: 1Gi
  Node Affinity: <none>
  Message:
  Source:
   Type: vSphereVolume (a Persistent Disk resource in vSphere)
   VolumePath: [vsanDatastore] d49c4a62-166f-ce12-c464-020077ba5d46/kubernetes-dynamic-pvc-74a498d6-3929-47e8-8c02-078c1ece4d78.vmdk
   FSType: ext4
   StoragePolicyName: vSAN Default Storage Policy
  Events: <none>
  The finalizer external-provisioner.volume.kubernetes.io/finalizer is added for CSI volumes.
  The following is an example:Name: pvc-2f0bab97-85a8-4552-8044-eb8be45cf48d
  Labels: <none>
  Annotations: pv.kubernetes.io/provisioned-by: csi.vsphere.vmware.com
  Finalizers: [kubernetes.io/pv-protection external-provisioner.volume.kubernetes.io/finalizer]
  StorageClass: fast
  Status: Bound
  Claim: demo-app/nginx-logs
  Reclaim Policy: Delete
  Access Modes: RWO
  VolumeMode: Filesystem
  Capacity: 200Mi
  Node Affinity: <none>
  Message:
  Source:
   Type: CSI (a Container Storage Interface (CSI) volume source)
   Driver: csi.vsphere.vmware.com
   FSType: ext4
   VolumeHandle: 44830fa8-79b4-406b-8b58-621ba25353fd
   ReadOnly: false
   VolumeAttributes: storage.kubernetes.io/csiProvisionerIdentity=1648442357185-8081-csi.vsphere.vmware.com
   type=vSphere CNS Block Volume
  Events: <none>
  When the CSIMigration{provider} feature flag is enabled for a specific in-tree volume plugin,
  the kubernetes.io/pv-controller finalizer is replaced by the
  external-provisioner.volume.kubernetes.io/finalizer finalizer.The finalizers ensure that the PV object is removed only after the volume is deleted
  ```