mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
38 lines
1.4 KiB
Markdown
38 lines
1.4 KiB
Markdown
# Optional manifests
|
|
|
|
Opt-in manifests that are **not** part of the top-level walkthrough.
|
|
`kubectl apply -f manifests/` is non-recursive, so it does not apply this
|
|
directory; apply a subdirectory explicitly.
|
|
|
|
## network-policy/
|
|
|
|
A Kubernetes `NetworkPolicy` for the DSH sandboxes:
|
|
|
|
- ingress only from the gateway pods on TCP `3080` (HTTP + WebSocket);
|
|
- egress only to DNS and public HTTPS (provider APIs, package mirrors,
|
|
git-over-HTTPS).
|
|
|
|
Apply and delete it explicitly:
|
|
|
|
```bash
|
|
kubectl apply -f manifests/optional/network-policy/
|
|
kubectl delete -f manifests/optional/network-policy/
|
|
```
|
|
|
|
It requires a CNI that enforces `NetworkPolicy`. The selector uses the
|
|
agent-sandbox controller's pod tracking label, so the policy applies to
|
|
existing warm-pool and claimed sandboxes without recreation.
|
|
|
|
## gVisor, nodeSelector and provider keys
|
|
|
|
These are configured in the main manifests or with an extra Secret:
|
|
|
|
- **gVisor:** uncomment `runtimeClassName: gvisor` in the SandboxTemplate and
|
|
the Deployments before applying, or patch an existing install.
|
|
- **nodeSelector:** uncomment the field and replace the placeholder node label.
|
|
- **Provider keys:** create the optional `dsh-provider-keys-extra` Secret; the
|
|
base `dsh-provider-keys` Secret remains the one required key.
|
|
|
|
Full prerequisites, exact commands, verification and caveats:
|
|
[optional hardening](../../docs/optional-hardening.md).
|