From a8fa8fb0cbdedf0477e79cf0772342ce3618bb8d Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Wed, 1 Dec 2021 12:59:18 -0500 Subject: [PATCH 01/38] Adding docker image --- charts/tor/.helmignore | 23 ++++++ charts/tor/Chart.yaml | 24 ++++++ charts/tor/templates/NOTES.txt | 22 ++++++ charts/tor/templates/_helpers.tpl | 77 +++++++++++++++++++ charts/tor/templates/deployment.yaml | 71 ++++++++++++++++++ charts/tor/templates/hpa.yaml | 28 +++++++ charts/tor/templates/ingress.yaml | 61 +++++++++++++++ charts/tor/templates/secret.yaml | 11 +++ charts/tor/templates/service.yaml | 15 ++++ charts/tor/templates/serviceaccount.yaml | 12 +++ charts/tor/values-prod.yaml | 94 ++++++++++++++++++++++++ charts/tor/values.yaml | 88 ++++++++++++++++++++++ 12 files changed, 526 insertions(+) create mode 100644 charts/tor/.helmignore create mode 100644 charts/tor/Chart.yaml create mode 100644 charts/tor/templates/NOTES.txt create mode 100644 charts/tor/templates/_helpers.tpl create mode 100644 charts/tor/templates/deployment.yaml create mode 100644 charts/tor/templates/hpa.yaml create mode 100644 charts/tor/templates/ingress.yaml create mode 100644 charts/tor/templates/secret.yaml create mode 100644 charts/tor/templates/service.yaml create mode 100644 charts/tor/templates/serviceaccount.yaml create mode 100644 charts/tor/values-prod.yaml create mode 100644 charts/tor/values.yaml diff --git a/charts/tor/.helmignore b/charts/tor/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/tor/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/tor/Chart.yaml b/charts/tor/Chart.yaml new file mode 100644 index 0000000..8079f2d --- /dev/null +++ b/charts/tor/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: tor +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "0.4.6.7" diff --git a/charts/tor/templates/NOTES.txt b/charts/tor/templates/NOTES.txt new file mode 100644 index 0000000..38c98b2 --- /dev/null +++ b/charts/tor/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "tor.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "tor.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "tor.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "tor.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/charts/tor/templates/_helpers.tpl b/charts/tor/templates/_helpers.tpl new file mode 100644 index 0000000..b46f38c --- /dev/null +++ b/charts/tor/templates/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "tor.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "tor.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "tor.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "tor.labels" -}} +helm.sh/chart: {{ include "tor.chart" . }} +{{ include "tor.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "tor.selectorLabels" -}} +app.kubernetes.io/name: {{ include "tor.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "tor.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "tor.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + + +{{- define "helpers.list-env-variables"}} +{{- range $key, $val := .Values.env.normal }} +- name: {{ $key }} + value: {{ $val | quote}} +{{- end}} +{{- range $key, $val := .Values.env.secret }} +- name: {{ $key }} + valueFrom: + secretKeyRef: + name: "{{ include "tor.fullname" $ }}-secret" + key: {{ $key | quote}} +{{- end}} +{{- end }} \ No newline at end of file diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml new file mode 100644 index 0000000..322e975 --- /dev/null +++ b/charts/tor/templates/deployment.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "tor.fullname" . }} + labels: + {{- include "tor.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "tor.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "tor.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "tor.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + {{- include "helpers.list-env-variables" . | indent 12 }} + ports: + - name: http + containerPort: 9050 + protocol: TCP + livenessProbe: + tcpSocket: + port: 9050 + initialDelaySeconds: 30 + periodSeconds: 20 + readinessProbe: + tcpSocket: + port: 9050 + initialDelaySeconds: 30 + periodSeconds: 20 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - mountPath: /tor + name: tor-volume + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: tor-volume + emptyDir: {} \ No newline at end of file diff --git a/charts/tor/templates/hpa.yaml b/charts/tor/templates/hpa.yaml new file mode 100644 index 0000000..f9afc20 --- /dev/null +++ b/charts/tor/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "tor.fullname" . }} + labels: + {{- include "tor.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "tor.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/tor/templates/ingress.yaml b/charts/tor/templates/ingress.yaml new file mode 100644 index 0000000..1806a41 --- /dev/null +++ b/charts/tor/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "tor.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "tor.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/tor/templates/secret.yaml b/charts/tor/templates/secret.yaml new file mode 100644 index 0000000..33ec185 --- /dev/null +++ b/charts/tor/templates/secret.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "tor.fullname" . }}-secret + labels: + {{- include "tor.labels" . | nindent 4 }} +type: Opaque +data: + {{- range $key, $val := .Values.env.secret }} + {{ $key }}: {{ $val | b64enc }} + {{- end}} \ No newline at end of file diff --git a/charts/tor/templates/service.yaml b/charts/tor/templates/service.yaml new file mode 100644 index 0000000..4e9f75e --- /dev/null +++ b/charts/tor/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "tor.fullname" . }} + labels: + {{- include "tor.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "tor.selectorLabels" . | nindent 4 }} diff --git a/charts/tor/templates/serviceaccount.yaml b/charts/tor/templates/serviceaccount.yaml new file mode 100644 index 0000000..14aa04b --- /dev/null +++ b/charts/tor/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "tor.serviceAccountName" . }} + labels: + {{- include "tor.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml new file mode 100644 index 0000000..92b7e09 --- /dev/null +++ b/charts/tor/values-prod.yaml @@ -0,0 +1,94 @@ +# Default values for tor. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: barneybuffet/tor + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "0.4.6.7" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + + + +env: + normal: + TOR_LOG_CONFIG: 'false' + TOR_PROXY: 'true' + TOR_PROXY_PORT: '0.0.0.0:9050' + TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' + TOR_PROXY_CONTROL_PORT: '127.0.0.1:9051' + TOR_PROXY_CONTROL_COOKIE: 'false' + TOR_SERVICE: 'false' + TOR_RELAY: 'false' + secret: + TOR_PROXY_CONTROL_PASSWORD: 'password' + + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 9050 + +ingress: + enabled: false + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + limits: + cpu: 1000m + memory: 1024Mi + requests: + cpu: 100m + memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml new file mode 100644 index 0000000..641ff4a --- /dev/null +++ b/charts/tor/values.yaml @@ -0,0 +1,88 @@ +# Default values for tor. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: barneybuffet/tor + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "0.4.6.7" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + + + +env: + normal: + TOR_LOG_CONFIG: 'false' + TOR_PROXY: 'true' + TOR_PROXY_PORT: '0.0.0.0:9050' + TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' + TOR_PROXY_CONTROL_PORT: '127.0.0.1:9051' + TOR_PROXY_CONTROL_COOKIE: 'false' + TOR_SERVICE: 'false' + TOR_RELAY: 'false' + secret: + TOR_PROXY_CONTROL_PASSWORD: 'password' + + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 9050 + +ingress: + enabled: false + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} From 0119d82f2d6df565dac0d1d64059edd5dd6ec780 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Wed, 1 Dec 2021 13:03:02 -0500 Subject: [PATCH 02/38] Updating port name --- charts/tor/templates/deployment.yaml | 2 +- charts/tor/templates/service.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index 322e975..ca4daff 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -36,7 +36,7 @@ spec: env: {{- include "helpers.list-env-variables" . | indent 12 }} ports: - - name: http + - name: socks containerPort: 9050 protocol: TCP livenessProbe: diff --git a/charts/tor/templates/service.yaml b/charts/tor/templates/service.yaml index 4e9f75e..a094d9a 100644 --- a/charts/tor/templates/service.yaml +++ b/charts/tor/templates/service.yaml @@ -8,8 +8,8 @@ spec: type: {{ .Values.service.type }} ports: - port: {{ .Values.service.port }} - targetPort: http + targetPort: socks protocol: TCP - name: http + name: socks selector: {{- include "tor.selectorLabels" . | nindent 4 }} From 69ee3191ac2b8965f603047572db41281414f900 Mon Sep 17 00:00:00 2001 From: yev-dimo <74260741+yev-dimo@users.noreply.github.com> Date: Mon, 13 Dec 2021 00:49:51 -0500 Subject: [PATCH 03/38] Adding safe to evict --- charts/tor/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 641ff4a..81346ff 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -39,7 +39,8 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" -podAnnotations: {} +podAnnotations: + "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" podSecurityContext: {} # fsGroup: 2000 From 4983902a780e4de03a881c580b380c70c2ac0e6f Mon Sep 17 00:00:00 2001 From: yev-dimo <74260741+yev-dimo@users.noreply.github.com> Date: Mon, 13 Dec 2021 00:50:12 -0500 Subject: [PATCH 04/38] Update values-prod.yaml --- charts/tor/values-prod.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 92b7e09..ce46737 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -39,7 +39,8 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" -podAnnotations: {} +podAnnotations: + "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" podSecurityContext: {} # fsGroup: 2000 From 9019ea8a83c86b8f918d846e853f0cc4ffa8b67f Mon Sep 17 00:00:00 2001 From: yev-dimo <74260741+yev-dimo@users.noreply.github.com> Date: Wed, 15 Dec 2021 13:39:19 -0500 Subject: [PATCH 05/38] Removing ephemeral volume --- charts/tor/templates/deployment.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index ca4daff..0ca7081 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -51,9 +51,6 @@ spec: periodSeconds: 20 resources: {{- toYaml .Values.resources | nindent 12 }} - volumeMounts: - - mountPath: /tor - name: tor-volume {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -66,6 +63,3 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} - volumes: - - name: tor-volume - emptyDir: {} \ No newline at end of file From ef9e5503ebf4abe0e4a17fb074601fe35dca4435 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Tue, 21 Dec 2021 15:08:40 -0500 Subject: [PATCH 06/38] Adding more tor pods for proxying --- charts/tor/values-prod.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index ce46737..6d8eecd 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 1 +replicaCount: 3 image: repository: barneybuffet/tor @@ -75,11 +75,11 @@ ingress: resources: limits: - cpu: 1000m - memory: 1024Mi - requests: - cpu: 100m + cpu: 200m memory: 128Mi + requests: + cpu: 50m + memory: 64Mi autoscaling: enabled: false From f3e70f1d9a03b8aeaa5a44919e551c910357bf13 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 12:56:32 -0500 Subject: [PATCH 07/38] Updating tor to enable admin port --- charts/tor/values-prod.yaml | 5 ++--- charts/tor/values.yaml | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 6d8eecd..18adfca 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -22,12 +22,11 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_PROXY_CONTROL_PORT: '127.0.0.1:9051' - TOR_PROXY_CONTROL_COOKIE: 'false' + TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_SERVICE: 'false' TOR_RELAY: 'false' secret: - TOR_PROXY_CONTROL_PASSWORD: 'password' + TOR_CONTROL_PASSWORD: 'password' serviceAccount: diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 81346ff..e24a7ba 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -22,12 +22,11 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_PROXY_CONTROL_PORT: '127.0.0.1:9051' - TOR_PROXY_CONTROL_COOKIE: 'false' + TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_SERVICE: 'false' TOR_RELAY: 'false' secret: - TOR_PROXY_CONTROL_PASSWORD: 'password' + TOR_CONTROL_PASSWORD: 'password' serviceAccount: From 2b9845ed38700d52b76bb234bc52a11023f570b4 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:07:47 -0500 Subject: [PATCH 08/38] Updating tor proxy to enable control port --- charts/tor/values-prod.yaml | 1 + charts/tor/values.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 18adfca..cba9ed7 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -22,6 +22,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' + TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_SERVICE: 'false' TOR_RELAY: 'false' diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index e24a7ba..aa7822c 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -22,6 +22,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' + TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_SERVICE: 'false' TOR_RELAY: 'false' From dc034d38805e0885b8509f0bde890d82e6b154d0 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:15:39 -0500 Subject: [PATCH 09/38] Changing env variables' --- charts/tor/values-prod.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index cba9ed7..2a8755b 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -24,10 +24,11 @@ env: TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' + TOR_CONTROL_SOCKET: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' secret: - TOR_CONTROL_PASSWORD: 'password' + TOR_CONTROL_PASSWORD: '' serviceAccount: From d590c0e96b0b172981620993c20ab5682a3e0e72 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:19:51 -0500 Subject: [PATCH 10/38] Switching to cookie auth --- charts/tor/values-prod.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 2a8755b..019429b 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -27,8 +27,6 @@ env: TOR_CONTROL_SOCKET: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' - secret: - TOR_CONTROL_PASSWORD: '' serviceAccount: From 502b83076f0b15d60cbd4678373779db98b44de5 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:25:11 -0500 Subject: [PATCH 11/38] Enabling local socket --- charts/tor/values-prod.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 019429b..0b7212d 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -25,10 +25,11 @@ env: TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' + TOR_CONTROL_COOKIE: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' - - + secret: + TOR_CONTROL_PASSWORD: 'password' serviceAccount: # Specifies whether a service account should be created create: true From b077f3e80a871355e415ddb89de5aa88dc6bfc1c Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:29:04 -0500 Subject: [PATCH 12/38] Removing port and using socket --- charts/tor/values-prod.yaml | 3 +-- charts/tor/values.yaml | 2 -- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 0b7212d..93bca7b 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -28,8 +28,7 @@ env: TOR_CONTROL_COOKIE: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' - secret: - TOR_CONTROL_PASSWORD: 'password' + serviceAccount: # Specifies whether a service account should be created create: true diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index aa7822c..dcbdbac 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -26,8 +26,6 @@ env: TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_SERVICE: 'false' TOR_RELAY: 'false' - secret: - TOR_CONTROL_PASSWORD: 'password' serviceAccount: From 2a53bb0e6e1d9b2daf98cb9911242257dbfbc18e Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 16:30:40 -0500 Subject: [PATCH 13/38] Disabling control for debug --- charts/tor/values-prod.yaml | 5 +++-- charts/tor/values.yaml | 6 +++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 93bca7b..ca2c483 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -22,13 +22,14 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'true' + TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' - + secret: + TOR_CONTROL_PASSWORD: 'password' serviceAccount: # Specifies whether a service account should be created create: true diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index dcbdbac..4248064 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -22,10 +22,14 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'true' + TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' + TOR_CONTROL_SOCKET: 'true' + TOR_CONTROL_COOKIE: 'true' TOR_SERVICE: 'false' TOR_RELAY: 'false' + secret: + TOR_CONTROL_PASSWORD: 'password' serviceAccount: From b6813101ca880569ee214f277984aaa8d5982e9b Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 17:01:33 -0500 Subject: [PATCH 14/38] Enabling tor control --- charts/tor/values-prod.yaml | 16 +++++++++------- charts/tor/values.yaml | 17 +++++++++-------- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index ca2c483..f939c51 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -18,6 +18,8 @@ fullnameOverride: "" env: normal: + PUID: 1000 + PGID: 1001 TOR_LOG_CONFIG: 'false' TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' @@ -30,6 +32,7 @@ env: TOR_RELAY: 'false' secret: TOR_CONTROL_PASSWORD: 'password' + serviceAccount: # Specifies whether a service account should be created create: true @@ -45,13 +48,12 @@ podAnnotations: podSecurityContext: {} # fsGroup: 2000 -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 +securityContext: + runAsUser: 1000 + runAsGroup: 1001 + fsGroup: 2000 + runAsNonRoot: true + fsGroupChangePolicy: "OnRootMismatch" service: type: ClusterIP diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 4248064..cf0c0fc 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -18,11 +18,13 @@ fullnameOverride: "" env: normal: + PUID: 1000 + PGID: 1001 TOR_LOG_CONFIG: 'false' TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'false' + TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' @@ -47,13 +49,12 @@ podAnnotations: podSecurityContext: {} # fsGroup: 2000 -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 +securityContext: + runAsUser: 1000 + runAsGroup: 1001 + fsGroup: 2000 + runAsNonRoot: true + fsGroupChangePolicy: "OnRootMismatch" service: type: ClusterIP From 4bb69df6591382db18248471eacd2eb1e154934a Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 17:09:53 -0500 Subject: [PATCH 15/38] Updating pod to run as a specific user --- charts/tor/values-prod.yaml | 18 +++++++++++------- charts/tor/values.yaml | 18 ++++++++++-------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index f939c51..42b9485 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -32,7 +32,7 @@ env: TOR_RELAY: 'false' secret: TOR_CONTROL_PASSWORD: 'password' - + serviceAccount: # Specifies whether a service account should be created create: true @@ -45,15 +45,19 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: +podSecurityContext: runAsUser: 1000 runAsGroup: 1001 fsGroup: 2000 - runAsNonRoot: true - fsGroupChangePolicy: "OnRootMismatch" + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + service: type: ClusterIP diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index cf0c0fc..290cdfb 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -24,7 +24,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'true' + TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' @@ -32,7 +32,6 @@ env: TOR_RELAY: 'false' secret: TOR_CONTROL_PASSWORD: 'password' - serviceAccount: # Specifies whether a service account should be created @@ -46,15 +45,18 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: +podSecurityContext: runAsUser: 1000 runAsGroup: 1001 fsGroup: 2000 - runAsNonRoot: true - fsGroupChangePolicy: "OnRootMismatch" + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 service: type: ClusterIP From 9274b9be8f4b299f6f5cf1aff2faffbdc0b8deaf Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 17:12:56 -0500 Subject: [PATCH 16/38] Running as non root but without docker user and groups --- charts/tor/values-prod.yaml | 10 +++++----- charts/tor/values.yaml | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 42b9485..b86c237 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -24,7 +24,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'false' + TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' @@ -45,10 +45,10 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" -podSecurityContext: - runAsUser: 1000 - runAsGroup: 1001 - fsGroup: 2000 +podSecurityContext: {} + # runAsUser: 1000 + # runAsGroup: 1001 + # fsGroup: 2000 securityContext: {} # capabilities: diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 290cdfb..592b58b 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -24,7 +24,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'false' + TOR_CONTROL: 'true' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' @@ -45,10 +45,10 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" -podSecurityContext: - runAsUser: 1000 - runAsGroup: 1001 - fsGroup: 2000 +podSecurityContext: {} + # runAsUser: 1000 + # runAsGroup: 1001 + # fsGroup: 2000 securityContext: {} # capabilities: From d11b503717c60ffe90e3ea71acd298f73f004b62 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 18:29:52 -0500 Subject: [PATCH 17/38] Testing setting quicker network rotation --- charts/tor/templates/deployment.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index 0ca7081..1676933 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -33,6 +33,7 @@ spec: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} + cmd: ["echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] env: {{- include "helpers.list-env-variables" . | indent 12 }} ports: @@ -42,12 +43,12 @@ spec: livenessProbe: tcpSocket: port: 9050 - initialDelaySeconds: 30 + initialDelaySeconds: 20 periodSeconds: 20 readinessProbe: tcpSocket: port: 9050 - initialDelaySeconds: 30 + initialDelaySeconds: 20 periodSeconds: 20 resources: {{- toYaml .Values.resources | nindent 12 }} From e19e876c35b4ec3be465554c31443ca2beb45198 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 18:30:48 -0500 Subject: [PATCH 18/38] Updating field name to args --- charts/tor/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index 1676933..eb059cd 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -33,7 +33,7 @@ spec: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} - cmd: ["echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] + args: ["echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] env: {{- include "helpers.list-env-variables" . | indent 12 }} ports: From 062da95413e40619b517314d0784d38b0e07c345 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 18:35:45 -0500 Subject: [PATCH 19/38] Increasing circuit speed --- charts/tor/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index eb059cd..2623fa7 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -33,7 +33,7 @@ spec: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} - args: ["echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] + args: ["sh","-c","echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] env: {{- include "helpers.list-env-variables" . | indent 12 }} ports: From 1650e851c42af7845f9a6d02c54abb5c1ff9a873 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 18:41:11 -0500 Subject: [PATCH 20/38] Rotate tor proxy more frequently --- charts/tor/templates/deployment.yaml | 2 +- charts/tor/values-prod.yaml | 2 +- charts/tor/values.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/tor/templates/deployment.yaml b/charts/tor/templates/deployment.yaml index 2623fa7..199a3f6 100644 --- a/charts/tor/templates/deployment.yaml +++ b/charts/tor/templates/deployment.yaml @@ -33,7 +33,7 @@ spec: {{- toYaml .Values.securityContext | nindent 12 }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} - args: ["sh","-c","echo 'MaxCircuitDirtiness 1800' >> /tor/torrc; tor -f /tor/torrc"] + args: ["sh","-c","echo 'MaxCircuitDirtiness 30' >> /tor/torrc; tor -f /tor/torrc"] env: {{- include "helpers.list-env-variables" . | indent 12 }} ports: diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index b86c237..5344046 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -24,7 +24,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'true' + TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 592b58b..58a875b 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -24,7 +24,7 @@ env: TOR_PROXY: 'true' TOR_PROXY_PORT: '0.0.0.0:9050' TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'true' + TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' TOR_CONTROL_SOCKET: 'true' TOR_CONTROL_COOKIE: 'true' From 3fa45808b58025819b6290bf4700faa71985ace8 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 7 Feb 2022 18:50:36 -0500 Subject: [PATCH 21/38] Reducing cpu and memory requirements for tor --- charts/tor/values-prod.yaml | 6 +++--- charts/tor/values.yaml | 10 ++++++++-- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 5344046..e95036e 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 3 +replicaCount: 9 image: repository: barneybuffet/tor @@ -84,8 +84,8 @@ resources: cpu: 200m memory: 128Mi requests: - cpu: 50m - memory: 64Mi + cpu: 10m + memory: 32Mi autoscaling: enabled: false diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 58a875b..6704a02 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 1 +replicaCount: 2 image: repository: barneybuffet/tor @@ -78,7 +78,13 @@ ingress: # hosts: # - chart-example.local -resources: {} +resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 10m + memory: 32Mi autoscaling: enabled: false From f61d955fbf1d6badb40e0d8d2dc03dbe9d3384fe Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Tue, 8 Feb 2022 22:01:38 -0500 Subject: [PATCH 22/38] Removing service account --- charts/tor/values-prod.yaml | 69 ------------------------------------- charts/tor/values.yaml | 6 ++-- 2 files changed, 3 insertions(+), 72 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index e95036e..2f9b994 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -10,75 +10,6 @@ image: # Overrides the image tag whose default is the chart appVersion. tag: "0.4.6.7" -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - - - -env: - normal: - PUID: 1000 - PGID: 1001 - TOR_LOG_CONFIG: 'false' - TOR_PROXY: 'true' - TOR_PROXY_PORT: '0.0.0.0:9050' - TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' - TOR_CONTROL: 'false' - TOR_CONTROL_PORT: '127.0.0.1:9051' - TOR_CONTROL_SOCKET: 'true' - TOR_CONTROL_COOKIE: 'true' - TOR_SERVICE: 'false' - TOR_RELAY: 'false' - secret: - TOR_CONTROL_PASSWORD: 'password' - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -podAnnotations: - "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" - -podSecurityContext: {} - # runAsUser: 1000 - # runAsGroup: 1001 - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - -service: - type: ClusterIP - port: 9050 - -ingress: - enabled: false - className: "" - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: chart-example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - resources: limits: cpu: 200m diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 6704a02..38480ea 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -26,8 +26,8 @@ env: TOR_PROXY_ACCEPT: 'accept 0.0.0.0/0' TOR_CONTROL: 'false' TOR_CONTROL_PORT: '127.0.0.1:9051' - TOR_CONTROL_SOCKET: 'true' - TOR_CONTROL_COOKIE: 'true' + TOR_CONTROL_SOCKET: 'false' + TOR_CONTROL_COOKIE: 'false' TOR_SERVICE: 'false' TOR_RELAY: 'false' secret: @@ -35,7 +35,7 @@ env: serviceAccount: # Specifies whether a service account should be created - create: true + create: false # Annotations to add to the service account annotations: {} # The name of the service account to use. From e0a6e85acc8172d5b881252fde27855c7826fae8 Mon Sep 17 00:00:00 2001 From: Yevgeny Khessin Date: Mon, 20 Jun 2022 01:28:44 -0400 Subject: [PATCH 23/38] Skip outbound tls on tor --- .gitignore | 3 ++- .vscode/settings.json | 5 ----- charts/tor/values.yaml | 1 + 3 files changed, 3 insertions(+), 6 deletions(-) delete mode 100644 .vscode/settings.json diff --git a/.gitignore b/.gitignore index 02afd87..8f9d4ca 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /tmp -/secrets \ No newline at end of file +/secrets +.vscode \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json deleted file mode 100644 index b468d56..0000000 --- a/.vscode/settings.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "cSpell.words": [ - "nonroot" - ] -} \ No newline at end of file diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 38480ea..d43fda7 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -44,6 +44,7 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" + "config.linkerd.io/skip-outbound-ports": "*" podSecurityContext: {} # runAsUser: 1000 From 662bd712256c3e6a35ac270782c7343c305b7f98 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Mon, 27 Jun 2022 01:58:46 -0400 Subject: [PATCH 24/38] Update values-prod.yaml --- charts/tor/values-prod.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 2f9b994..46d5e6e 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 9 +replicaCount: 5 image: repository: barneybuffet/tor From ea8bb4a0af56c73dc00d2966a3954b61ce031a9d Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Thu, 7 Jul 2022 13:52:21 -0400 Subject: [PATCH 25/38] Update values-prod.yaml --- charts/tor/values-prod.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 46d5e6e..364d63e 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 5 +replicaCount: 2 image: repository: barneybuffet/tor From ace36bc7de19751a5e0debe391faa57a86457d58 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Wed, 13 Jul 2022 17:07:52 -0400 Subject: [PATCH 26/38] Update values.yaml --- charts/tor/values.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index d43fda7..157db2f 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -46,18 +46,18 @@ podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" "config.linkerd.io/skip-outbound-ports": "*" -podSecurityContext: {} - # runAsUser: 1000 - # runAsGroup: 1001 - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 +podSecurityContext: + runAsUser: 1000 + runAsGroup: 1001 + fsGroup: 2000 + +securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 service: type: ClusterIP From 80fbba36d16b844fe5e71d52d6a0cff5937bda1a Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Wed, 13 Jul 2022 17:09:18 -0400 Subject: [PATCH 27/38] Update values.yaml --- charts/tor/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 157db2f..5c877b1 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -46,10 +46,10 @@ podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" "config.linkerd.io/skip-outbound-ports": "*" -podSecurityContext: - runAsUser: 1000 - runAsGroup: 1001 - fsGroup: 2000 +podSecurityContext: {} +# runAsUser: 1000 +# runAsGroup: 1001 +# fsGroup: 2000 securityContext: capabilities: From 26dc607ed0e33ea12beed0e3a0ca07a293cd07d6 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Wed, 13 Jul 2022 17:10:34 -0400 Subject: [PATCH 28/38] Update values.yaml --- charts/tor/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 5c877b1..f5e2f2c 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -55,9 +55,9 @@ securityContext: capabilities: drop: - ALL - readOnlyRootFilesystem: true +# readOnlyRootFilesystem: true runAsNonRoot: true - runAsUser: 1000 +# runAsUser: 1000 service: type: ClusterIP From 62f513ac6a0e524e1c1da23aa511598fb82e6aaa Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Wed, 13 Jul 2022 17:11:18 -0400 Subject: [PATCH 29/38] Update values.yaml --- charts/tor/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index f5e2f2c..561547f 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -56,7 +56,7 @@ securityContext: drop: - ALL # readOnlyRootFilesystem: true - runAsNonRoot: true +# runAsNonRoot: true # runAsUser: 1000 service: From 2729f077e9a317c95bbc20c9b5225dd8d91468f1 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Wed, 13 Jul 2022 17:12:51 -0400 Subject: [PATCH 30/38] Update values.yaml --- charts/tor/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 561547f..cd86dfb 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -51,10 +51,10 @@ podSecurityContext: {} # runAsGroup: 1001 # fsGroup: 2000 -securityContext: - capabilities: - drop: - - ALL +securityContext: {} +# capabilities: +# drop: +# - ALL # readOnlyRootFilesystem: true # runAsNonRoot: true # runAsUser: 1000 From fca9e89933abed35a338f14b15a48c6d9a4d3a31 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Thu, 14 Jul 2022 09:50:03 -0400 Subject: [PATCH 31/38] Update values.yaml --- charts/tor/values.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index cd86dfb..5e028cb 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -94,8 +94,13 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -nodeSelector: {} - -tolerations: [] +nodeSelector: + eks.amazonaws.com/nodegroup: public + +tolerations: +- key: "public" + value: "true" + operator: "Equal" + effect: "NoSchedule" affinity: {} From 8ed5bbc204184facf12d7c8bd02e10c05d466de6 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Thu, 14 Jul 2022 09:54:11 -0400 Subject: [PATCH 32/38] Update values.yaml --- charts/tor/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 5e028cb..f817b29 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -98,7 +98,7 @@ nodeSelector: eks.amazonaws.com/nodegroup: public tolerations: -- key: "public" +- key: public value: "true" operator: "Equal" effect: "NoSchedule" From 58433534d1ecda99cec4f3c86323016c5ce63f21 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Thu, 14 Jul 2022 10:00:23 -0400 Subject: [PATCH 33/38] Fixing tolerations for pods --- charts/tor/values-prod.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 364d63e..4c6cd52 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -25,8 +25,13 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -nodeSelector: {} +nodeSelector: + eks.amazonaws.com/nodegroup: public -tolerations: [] +tolerations: +- key: public + value: "true" + operator: "Equal" + effect: "NoSchedule" affinity: {} From 36d0b52ac3507102f1034c0422bc1b3fff3583f4 Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Tue, 20 Jun 2023 08:46:41 -0400 Subject: [PATCH 34/38] Update values.yaml --- charts/tor/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index f817b29..20ef49d 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -44,9 +44,8 @@ serviceAccount: podAnnotations: "cluster-autoscaler.kubernetes.io/safe-to-evict": "true" - "config.linkerd.io/skip-outbound-ports": "*" -podSecurityContext: {} +podSecurityContext: # runAsUser: 1000 # runAsGroup: 1001 # fsGroup: 2000 From 4e5f608c62b6e1f0c1836cdcd06c20cfb4b576ee Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Mon, 4 Sep 2023 02:17:54 -0400 Subject: [PATCH 35/38] Update values.yaml --- charts/tor/values.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 20ef49d..6c1d595 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -93,9 +93,6 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -nodeSelector: - eks.amazonaws.com/nodegroup: public - tolerations: - key: public value: "true" From 584eb0e31cb1739c7ba03c8d6056bfb1f2b7f47b Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Mon, 4 Sep 2023 02:18:05 -0400 Subject: [PATCH 36/38] Update values-prod.yaml --- charts/tor/values-prod.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 4c6cd52..61e951b 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -25,9 +25,6 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -nodeSelector: - eks.amazonaws.com/nodegroup: public - tolerations: - key: public value: "true" From 058dc6dab75ee1349c22264fa17a7df1efa8c34d Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Mon, 4 Sep 2023 02:25:38 -0400 Subject: [PATCH 37/38] Update values.yaml --- charts/tor/values.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/tor/values.yaml b/charts/tor/values.yaml index 6c1d595..fba2df0 100644 --- a/charts/tor/values.yaml +++ b/charts/tor/values.yaml @@ -98,5 +98,8 @@ tolerations: value: "true" operator: "Equal" effect: "NoSchedule" - +- key: streamr + value: "true" + operator: "Equal" + effect: "NoSchedule" affinity: {} From d73fbc53d6afb65587012c2436e1da636e5994ad Mon Sep 17 00:00:00 2001 From: zer0stars <74260741+zer0stars@users.noreply.github.com> Date: Mon, 4 Sep 2023 02:25:56 -0400 Subject: [PATCH 38/38] Update values-prod.yaml --- charts/tor/values-prod.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/tor/values-prod.yaml b/charts/tor/values-prod.yaml index 61e951b..56d4cab 100644 --- a/charts/tor/values-prod.yaml +++ b/charts/tor/values-prod.yaml @@ -30,5 +30,8 @@ tolerations: value: "true" operator: "Equal" effect: "NoSchedule" - +- key: streamr + value: "true" + operator: "Equal" + effect: "NoSchedule" affinity: {}