# web-allowed: a stock HTTP server the egress policy will ALLOW the clients to reach.
# It is an ordinary pod (no runtimeClassName) and is reached by its pod IP on the
# ClusterIP Service's port, so the sample needs no Ingress, LoadBalancer or NodePort.
#
# python -m http.server runs as an arbitrary non-root UID, serves its working directory
# (/srv) read-only, and needs no Linux capability on a port above 1024, so the container
# runs with a read-only root filesystem, all capabilities dropped and a fixed high UID.
apiVersion: v1
kind: Pod
metadata:
  name: web-allowed
  labels:
    app: web-allowed
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: web
      image: public.ecr.aws/docker/library/python:3.12-alpine
      imagePullPolicy: IfNotPresent
      command: ["python3", "-m", "http.server", "8080"]
      workingDir: /srv
      ports:
        - { containerPort: 8080 }
      # The probe is a kubelet-local TCP connect to the container port; it does not go
      # through the egress NetworkPolicy, so it does not change what the clients see.
      readinessProbe:
        tcpSocket: { port: 8080 }
        initialDelaySeconds: 2
        periodSeconds: 10
      livenessProbe:
        tcpSocket: { port: 8080 }
        initialDelaySeconds: 2
        periodSeconds: 10
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
---
apiVersion: v1
kind: Service
metadata:
  name: web-allowed
spec:
  selector:
    app: web-allowed
  ports:
    - { protocol: TCP, port: 8080, targetPort: 8080 }