# probe-sandboxed-conntrack-raised: the OPTIONAL variant for the connection
# limit. Identical to probe-sandboxed, with one annotation added that raises the
# per-pod outbound connection limit:
#
#   sandbox.amazonaws.com/conntrack-limit: "8192"
#
# The Amazon EKS User Guide (Isolated and confidential pods limitations, "Per-pod
# outbound connection limit") documents this annotation: the default is 4096
# simultaneous outbound connections per IP address family, and this annotation
# sets it per pod (the value must be an integer between 64 and 65536). Setting it
# here lets the sample show the measured plateau move from about the default to
# about the raised value, direct evidence that the plateau is this limit.
#
# This pod carries the same app: dns-probe label, so the egress NetworkPolicy
# selects it too.
apiVersion: v1
kind: Pod
metadata:
  name: probe-sandboxed-conntrack-raised
  namespace: sandbox-limits
  labels:
    app: dns-probe
  annotations:
    karpenter.sh/do-not-disrupt: "true"
    # Raise the per-pod outbound connection limit above the 4096 default.
    # Documented in the Amazon EKS User Guide, Isolated and confidential pods
    # limitations.
    sandbox.amazonaws.com/conntrack-limit: "8192"
spec:
  runtimeClassName: isolated-sandbox
  # Hardened to clear ASH/checkov CKV_K8S_20,22,23,28,29,30,31,37,38,40.
  # Identical on every probe pod and the sink, so it does not change the
  # one-line difference between the pods. The probe uses ordinary UDP/TCP
  # sockets and reads world-readable files only, so a non-root UID and
  # dropped capabilities do not change the measured limit.
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: probe
      image: public.ecr.aws/docker/library/python:3.12-slim
      imagePullPolicy: IfNotPresent
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        readOnlyRootFilesystem: true
      volumeMounts:
        # readOnlyRootFilesystem needs a writable /tmp: the container does
        # `touch /tmp/ready` and the readiness probe `cat /tmp/ready`.
        - name: tmp
          mountPath: /tmp
      command: ["/bin/sh", "-c"]
      args:
        - |
          touch /tmp/ready
          exec sleep infinity
      readinessProbe:
        exec:
          command: ["cat", "/tmp/ready"]
        initialDelaySeconds: 2
        periodSeconds: 3
        failureThreshold: 40
      resources:
        requests:
          cpu: "1"
          memory: 768Mi
        limits:
          cpu: "1"
          memory: 768Mi
  volumes:
    - name: tmp
      emptyDir: {}