diff --git a/apps/k8s01/tor/deployment.yaml b/apps/k8s01/tor/deployment.yaml deleted file mode 100644 index c33de69e55af30511635c892f907e4b5ecc9222a..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/deployment.yaml +++ /dev/null @@ -1,76 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/name: tor - name: tor - namespace: tor -spec: - replicas: 2 - selector: - matchLabels: - app.kubernetes.io/name: tor - template: - metadata: - labels: - app.kubernetes.io/name: tor - spec: - securityContext: - runAsUser: 101 - runAsGroup: 101 - fsGroup: 101 - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app.kubernetes.io/name: tor - matchLabelKeys: - - pod-template-hash - containers: - - image: thetorproject/obfs4-bridge:latest - name: torproxy - command: - - tor - args: - - --SOCKSPort - - 0.0.0.0:9050 - # We only allow 443 and 80 to go out - - --FascistFirewall - - "1" - readinessProbe: - exec: - command: - - sh - - -c - - curl -v --proxy socks5://127.0.0.1:9050 http://www.gstatic.com/generate_204 2>&1 | grep 'HTTP/1.1 204 No Content' - ports: - - name: socks - containerPort: 9050 - protocol: TCP - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: "1" - memory: 512Mi - securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - volumeMounts: - - name: home - mountPath: /var/lib/tor/ - volumes: - - name: home - emptyDir: - medium: Memory - sizeLimit: 128Mi - diff --git a/apps/k8s01/tor/egress-policy.yaml b/apps/k8s01/tor/egress-policy.yaml deleted file mode 100644 index e144d9b97f5ba4008f45c1656935bf1741d6fce7..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/egress-policy.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-to-public-web -spec: - podSelector: - matchLabels: - app.kubernetes.io/name: tor ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-to-kubedns -spec: - podSelector: - matchLabels: - app.kubernetes.io/name: tor \ No newline at end of file diff --git a/apps/k8s01/tor/kustomization.yaml b/apps/k8s01/tor/kustomization.yaml deleted file mode 100644 index c1b1b075e53b3f9148ff4b9c976d568b67f07b2b..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: tor -resources: - - namespace.yaml - - deployment.yaml - - service.yaml - - networkpolicy.yaml - - ../../../shared/networkpolicies/deny-by-default-ingress.yaml - - ../../../shared/networkpolicies/allow-to-kubedns.yaml - - ../../../shared/networkpolicies/allow-to-public-web.yaml - - ../../../shared/networkpolicies/deny-by-default-egress.yaml - - ../../../shared/resourcequotas/default.yaml -patchesStrategicMerge: - - egress-policy.yaml \ No newline at end of file diff --git a/apps/k8s01/tor/namespace.yaml b/apps/k8s01/tor/namespace.yaml deleted file mode 100644 index dfc518043b7a31a92d66f7aa383a20696d429ddd..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/namespace.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: tor - labels: - pod-security.kubernetes.io/audit: restricted - pod-security.kubernetes.io/enforce: baseline - pod-security.kubernetes.io/warn: restricted - pod-security.kubernetes.io/audit-version: v1.26 - pod-security.kubernetes.io/enforce-version: v1.23 - pod-security.kubernetes.io/warn-version: v1.26 diff --git a/apps/k8s01/tor/networkpolicy.yaml b/apps/k8s01/tor/networkpolicy.yaml deleted file mode 100644 index 16695f102195b29163781909eb82600fc5c4e246..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-from-tor-enabled - namespace: tor - labels: - app.kubernetes.io/name: tor -spec: - podSelector: - matchLabels: - app.kubernetes.io/name: tor - ingress: - - from: - - namespaceSelector: - matchLabels: - tor.shivering-isles.com/egress-enabled: "true" - podSelector: - matchLabels: - tor.shivering-isles.com/egress-enabled: "true" - ports: - - port: 9050 - protocol: TCP - policyTypes: - - Ingress \ No newline at end of file diff --git a/apps/k8s01/tor/service.yaml b/apps/k8s01/tor/service.yaml deleted file mode 100644 index 8a2b3b99cb4875626fa9e90ed4e52d4450b0f02e..0000000000000000000000000000000000000000 --- a/apps/k8s01/tor/service.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/name: tor - name: tor - namespace: tor -spec: - ports: - - name: socks - port: 9050 - protocol: TCP - targetPort: socks - selector: - app.kubernetes.io/name: tor - type: ClusterIP \ No newline at end of file