# DSH "Agents as a Service" — prerequisites: namespace + shared provider keys.
#
# The dsh-provider-keys Secret is deliberately NOT committed with a usable
# value. DEEPSEEK_API_KEY reaches every tenant sandbox (injected via envFrom
# on the SandboxTemplate, stamped before any user exists — a warm-pool
# constraint), so a real key committed here would be shared by every install
# of this example. Generate a fresh value per install (README step 1;
# scripts/e2e-kind.sh uses a throwaway). Use an upsert: this manifest already
# creates the empty Secret, so a plain `kubectl create` would fail:
#
#   kubectl -n dsh-demo create secret generic dsh-provider-keys \
#     --from-literal=DEEPSEEK_API_KEY="sk-..." \
#     --dry-run=client -o yaml | kubectl apply -f -
#
# Optional: additional providers (OpenRouter, Gemini, NVIDIA, OpenAI, ...) go
# in a second, optional Secret. The SandboxTemplate references it with
# `optional: true`, so sandboxes start even when it does not exist, and every
# key in it becomes an environment variable. Create it BEFORE the warm pool,
# because pod env is stamped at pod creation:
#
#   kubectl -n dsh-demo create secret generic dsh-provider-keys-extra \
#     --from-literal=OPENROUTER_API_KEY="sk-or-..." \
#     --from-literal=GEMINI_API_KEY="..." \
#     --from-literal=NVIDIA_API_KEY="nvapi-..." \
#     --dry-run=client -o yaml | kubectl apply -f -
#
# Supported env names, precedence, shared-key caveats and the pod-refresh
# procedure are in docs/optional-hardening.md.
#
# All the infrastructure in this example works without a real key; only
# actual model calls need one.
apiVersion: v1
kind: Namespace
metadata:
  name: dsh-demo
---
apiVersion: v1
kind: Secret
metadata:
  name: dsh-provider-keys
  namespace: dsh-demo
type: Opaque
# stringData:
#   DEEPSEEK_API_KEY: "sk-your-key-here"