ae8aba8241
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.
1.9 KiB
Optional manifests
Opt-in manifests that are not part of the top-level walkthrough.
kubectl apply -f manifests/ is non-recursive, so it does not apply this
directory; apply a subdirectory explicitly.
network-policy/
A Kubernetes NetworkPolicy for the DSH sandboxes:
- ingress only from the gateway pods on TCP
3080(HTTP + WebSocket); - egress only to DNS and public HTTPS (provider APIs, package mirrors, git-over-HTTPS).
Apply and delete it explicitly:
kubectl apply -f manifests/optional/network-policy/
kubectl delete -f manifests/optional/network-policy/
It requires a CNI that enforces NetworkPolicy. The selector uses the
agent-sandbox controller's pod tracking label, so the policy applies to
existing warm-pool and claimed sandboxes without recreation.
This is opt-in for the demo but required for production. Without it every tenant can reach every other tenant and cluster-internal endpoints. Production also needs the gateway egress policy (cluster-specific API-server endpoint) and the exposure variant's policy; see the production checklist.
gVisor, nodeSelector and provider keys
These are configured in the main manifests or with an extra Secret:
- gVisor: uncomment
runtimeClassName: gvisorin the SandboxTemplate and the Deployments before applying, or patch an existing install. - nodeSelector: uncomment the field and replace the placeholder node label.
- Failed-Pod recovery: uncomment
failedPodPolicy: Recreatein the SandboxTemplate (agent-sandbox v1.0.8+) so a Failed Pod is replaced instead of parked. - Provider keys: create the optional
dsh-provider-keys-extraSecret; the basedsh-provider-keysSecret remains the one required key.
Full prerequisites, exact commands, verification and caveats: optional hardening.