feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21)

Add opt-in hardening to the agents-as-a-service example:
- commented runtimeClassName/nodeSelector fields for sandboxes and Deployments
- optional sandbox NetworkPolicy plus exposure-variant policies
- optional dsh-provider-keys-extra Secret for extra provider keys
- docs/optional-hardening.md with verification, caveats and rollback

The base walkthrough stays portable; no gateway code, routes or auth changed.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

examples/minimal-single-tenant/README.md

@@ -25,19 +25,28 @@ This example deliberately has no gateway: you reach DSH through a
   ```
 
 - A DeepSeek API key for real model calls. The pod starts without one; only
-  model requests fail.
+  model requests fail. Optionally create `dsh-provider-keys-extra` for
+  OpenRouter, Gemini, NVIDIA or other provider keys (the template references it
+  with `optional: true`).
 
 ## Quickstart
 
 Run these from this example's directory (`examples/minimal-single-tenant/`).
 
 ```bash
-# 1. Namespace + shared provider key. The key is injected into the sandbox via
-#    envFrom and is never committed.
+# 1. Namespace + shared provider keys. They are injected into the sandbox via
+#    envFrom and are never committed.
 kubectl create namespace dsh-demo
 kubectl -n dsh-demo create secret generic dsh-provider-keys \
   --from-literal=DEEPSEEK_API_KEY="sk-..."
 
+# Optional: extra providers, injected through a second Secret. Create it before
+# the warm pool so the pods are stamped with the keys.
+kubectl -n dsh-demo create secret generic dsh-provider-keys-extra \
+  --from-literal=OPENROUTER_API_KEY="sk-or-..." \
+  --from-literal=GEMINI_API_KEY="..." \
+  --from-literal=NVIDIA_API_KEY="nvapi-..."
+
 # 2. The template itself (image pinned in the manifest).
 kubectl apply -f manifests/sandbox-template.yaml
 
@@ -86,6 +95,22 @@ kubectl -n dsh-demo port-forward "pod/$SB" 18081:3080
 > use on your workstation, forward to another local port (here `18081`), never
 > `3080`. `localhost` is always in DSH's trusted-host list, so the forwarded
 > request is accepted.
+>
+> **gVisor caveat:** if you uncomment `runtimeClassName: gvisor` in the
+> template, `kubectl port-forward` no longer works. Use the multi-tenant gateway
+> example or a reachable Service instead; see
+> [optional hardening](../dsh-agents-as-a-service/docs/optional-hardening.md).
+
+## Network policy and optional hardening
+
+The template omits `networkPolicyManagement`, so the agent-sandbox controller
+uses its Managed secure default: ingress only from the sandbox-router, public
+egress, and no internal cluster DNS. `kubectl port-forward` is local to the pod
+and still works (except under gVisor).
+
+gVisor, an optional `nodeSelector`, extra provider keys and a stricter sandbox
+NetworkPolicy are documented in
+[optional hardening](../dsh-agents-as-a-service/docs/optional-hardening.md).
 
 ## Probes and trusted hosts
 

examples/minimal-single-tenant/manifests/sandbox-template.yaml

@@ -10,6 +10,9 @@
 #   - Namespace dsh-demo.
 #   - Secret dsh-provider-keys in dsh-demo with key DEEPSEEK_API_KEY
 #     (injected via envFrom; the pod starts without it, only model calls fail).
+#   - Optional: Secret dsh-provider-keys-extra with additional provider keys
+#     (OPENROUTER_API_KEY, GEMINI_API_KEY, NVIDIA_API_KEY, ...). It is
+#     referenced with `optional: true`, so it may be absent.
 # The agent-sandbox controller (v1.0.7, API v1beta1) must be installed.
 apiVersion: extensions.agents.x-k8s.io/v1beta1
 kind: SandboxTemplate
@@ -18,8 +21,22 @@ metadata:
   namespace: dsh-demo
 spec:
   service: true # headless Service per Sandbox -> stable DNS (status.serviceFQDN)
+  # networkPolicyManagement is omitted, so the controller uses its Managed
+  # secure default (ingress only from the sandbox-router, public egress). This
+  # quickstart reaches the sandbox through `kubectl port-forward`, which is
+  # local to the pod. The multi-tenant example documents opt-in policies in
+  # examples/dsh-agents-as-a-service/docs/optional-hardening.md.
   podTemplate:
     spec:
+      # OPTIONAL: run under gVisor. gVisor breaks `kubectl port-forward`, so
+      # this quickstart's only access path will not work; use the multi-tenant
+      # gateway example or a Service/NodePort instead.
+      # runtimeClassName: gvisor
+      #
+      # OPTIONAL: pin to a dedicated node pool. Replace the placeholder with a
+      # node label; add a matching toleration if the pool is tainted.
+      # nodeSelector:
+      #   dsh.example.com/node-pool: dsh
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000 # Matches the UID of the 'node' user
@@ -43,6 +60,10 @@ spec:
           envFrom:
             - secretRef:
                 name: dsh-provider-keys # Secret with key DEEPSEEK_API_KEY
+            # Optional extra provider keys; an absent Secret is safe.
+            - secretRef:
+                name: dsh-provider-keys-extra
+                optional: true
           env:
             # Empty => DSH derives links from the request Host. Keep it empty
             # when fronting the sandbox with a proxy/gateway.