Clean stale VPN state synchronously before gluetun starts

Replace the upstream-recommended postStart hook, which runs
concurrently with the entrypoint and loses the race (observed: it
deleted the ip rule the restarted gluetun had just created, leaving the
container in a permanent CrashLoop behind the kill switch). A command
wrapper now removes stale table-51820 rules and the leftover tun
device deterministically before exec'ing /gluetun-entrypoint, covering
container restarts after unclean exits.

freesailarr/templates/freesailarr.sfs.yaml

@@ -27,17 +27,18 @@ spec:
         - name: gluetun
           image: "qmcgaw/gluetun:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
-          # An uncleanly exited gluetun (crash, OOM, node issue) leaves its ip
+          # An uncleanly exited gluetun (crash, OOM killer, node issue) leaves
-          # rule behind in the shared pod network namespace, and the restarted
+          # its ip rule, routing table and tun device behind in the shared pod
-          # container then fails forever with "ip rule 101 ... file exists".
+          # network namespace, and the restarted container then fails forever
-          # Upstream-recommended fix for Kubernetes: drop stale rules on start.
+          # ("adding ip rule 101 ... file exists" / silent tunnel breakage)
-          lifecycle:
+          # while the kill switch blocks all egress. The upstream-recommended
-            postStart:
+          # postStart hook is racy (it runs concurrently with the entrypoint
-              exec:
+          # and can delete the rule the new instance just created), so the
-                command:
+          # stale state is cleaned synchronously before gluetun starts.
-                  - /bin/sh
+          command:
-                  - -c
+            - /bin/sh
-                  - (ip rule del table 51820; ip -6 rule del table 51820) || true
+            - -c
+            - 'while ip rule del table 51820 2>/dev/null; do :; done; while ip -6 rule del table 51820 2>/dev/null; do :; done; ip link del tun0 2>/dev/null; exec /gluetun-entrypoint'
           env:
             - name: TZ
               value: {{ .Values.timezone | quote }}