Add squid-proxy to readme

Author: norman465

serverless-fleets/README.md

@@ -19,6 +19,7 @@ Using both the intuitive graphical user interface and the command line, you will
 - [Tutorial: Docling](./tutorials/docling/README.md)
 - [Tutorial: Batch Inferencing](./tutorials/inferencing/README.md)
 - [Tutorial: Monte Carlo Simulation](./tutorials/simulation/README.md)
+- [Example: HTTP egress control](#http-egress-control)
 - [HowTo](#howto)
 - [Troubleshooting](#troubleshooting)
 
@@ -522,6 +523,13 @@ Download the results from the output COS bucket to `./data/output`
 - [Tutorial: Simulation](./tutorials/simulation/README.md)
 
 
+## Examples
+
+### HTTP egress control
+
+In order to control/monitor/capture HTTP egress traffic on your tasks for which security group based network controls are not sufficient i.e. hostname based controls: you can use after startup hooks to deploy a HTTP proxy on each worker node that intercepts all HTTP traffic of the tasks running on that worker node. An example using squid proxy to allowlist only traffic to a single domain can be found in `run_hook_squid_http_proxy`.
+
+
 ## HowTo
 
 ### How to use your own container and image
@@ -551,7 +559,6 @@ Once the push is complete, you can run the fleet by modifying `./run` and replac
 - the environment variables, e.g. `--env foo=bar`
 
 
-
 ### How to access logs
 
 An IBM Cloud Logs instance is being setup and enabled by default during the automated One Time Setup. Each fleet worker will ingest logs to the IBM Cloud Logs instance by default. [Navigating to the UI](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-instance-launch) and use [Using Livetail](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-livetail) or [Filtering log data](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-query-data-filter) to view the logs.

serverless-fleets/run_hook_squid_http_proxy

@@ -98,12 +98,11 @@ OUTER
 
 ibmcloud ce fleet create  --name "fleet-${uuid}" \
   --tasks-state-store fleet-task-store \
-  --tasks 1 \
   --image registry.access.redhat.com/ubi10/ubi-minimal \
   --cpu "2" \
   --memory "4G" \
-  --command curl --argument "--silent" --argument "--write-out" --argument "%{http_code}" --argument "--output" --argument "/dev/null" --argument "http://example.com" \
-  --max-scale 1 \
+  --tasks-from-local-file run_hook_squid_http_proxy_commands.jsonl \
+  --max-scale 2 \
   --retrylimit 0 \
   --subnetpool-name fleet-subnetpool \
   --env __CE_INTERNAL_HOOK_AFTER_STARTUP="${PREHOOK}"

serverless-fleets/run_hook_squid_http_proxy_commands.jsonl

@@ -0,0 +1,2 @@
+{ "command":"curl", "args": ["--silent", "--write-out", "%{url} %{http_code}", "--output", "/dev/null", "http://example.com"]}
+{ "command":"curl", "args": ["--silent", "--write-out", "%{url} %{http_code}", "--output", "/dev/null", "http://google.com"]}