# DSH "Agents as a Service" — prerequisites: namespace + shared provider key.
#
# The dsh-provider-keys Secret is deliberately NOT committed with a usable
# value. DEEPSEEK_API_KEY reaches every tenant sandbox (injected via envFrom
# on the SandboxTemplate, stamped before any user exists — a warm-pool
# constraint), so a real key committed here would be shared by every install
# of this example. Generate a fresh value per install (README step 1;
# run-test-kind.sh uses a throwaway):
#
#   kubectl -n dsh-demo create secret generic dsh-provider-keys \
#     --from-literal=DEEPSEEK_API_KEY="sk-..."
#
# All the infrastructure in this example works without a real key; only
# actual model calls need one.
apiVersion: v1
kind: Namespace
metadata:
  name: dsh-demo
---
apiVersion: v1
kind: Secret
metadata:
  name: dsh-provider-keys
  namespace: dsh-demo
type: Opaque
# stringData:
#   DEEPSEEK_API_KEY: "sk-your-key-here"