mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
# DSH "Agents as a Service" — prerequisites: namespace + shared provider keys.
|
|
#
|
|
# The dsh-provider-keys Secret is deliberately NOT committed with a usable
|
|
# value. DEEPSEEK_API_KEY reaches every tenant sandbox (injected via envFrom
|
|
# on the SandboxTemplate, stamped before any user exists — a warm-pool
|
|
# constraint), so a real key committed here would be shared by every install
|
|
# of this example. Generate a fresh value per install (README step 1;
|
|
# scripts/e2e-kind.sh uses a throwaway). Use an upsert: this manifest already
|
|
# creates the empty Secret, so a plain `kubectl create` would fail:
|
|
#
|
|
# kubectl -n dsh-demo create secret generic dsh-provider-keys \
|
|
# --from-literal=DEEPSEEK_API_KEY="sk-..." \
|
|
# --dry-run=client -o yaml | kubectl apply -f -
|
|
#
|
|
# Optional: additional providers (OpenRouter, Gemini, NVIDIA, OpenAI, ...) go
|
|
# in a second, optional Secret. The SandboxTemplate references it with
|
|
# `optional: true`, so sandboxes start even when it does not exist, and every
|
|
# key in it becomes an environment variable. Create it BEFORE the warm pool,
|
|
# because pod env is stamped at pod creation:
|
|
#
|
|
# kubectl -n dsh-demo create secret generic dsh-provider-keys-extra \
|
|
# --from-literal=OPENROUTER_API_KEY="sk-or-..." \
|
|
# --from-literal=GEMINI_API_KEY="..." \
|
|
# --from-literal=NVIDIA_API_KEY="nvapi-..." \
|
|
# --dry-run=client -o yaml | kubectl apply -f -
|
|
#
|
|
# Supported env names, precedence, shared-key caveats and the pod-refresh
|
|
# procedure are in docs/optional-hardening.md.
|
|
#
|
|
# All the infrastructure in this example works without a real key; only
|
|
# actual model calls need one.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: dsh-demo
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: dsh-provider-keys
|
|
namespace: dsh-demo
|
|
type: Opaque
|
|
# stringData:
|
|
# DEEPSEEK_API_KEY: "sk-your-key-here"
|