mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
197 lines
7.4 KiB
YAML
197 lines
7.4 KiB
YAML
# The gateway: control+data plane that turns the resources into a usable
|
|
# browser-facing service. It is a Starlette ASGI app (see gateway/) listening
|
|
# on :8080 and exposing:
|
|
# GET /healthz unauthenticated health probe
|
|
# GET / landing page (signup / token login)
|
|
# POST /users, POST /login, ... session cookie auth
|
|
# /u/<user>/... HTTP + WebSocket proxy to the user's DSH
|
|
#
|
|
# Image: the release image published for this example, pinned by tag.
|
|
# imagePullPolicy: IfNotPresent lets a local kind build loaded under the same
|
|
# tag be used without a registry round-trip (scripts/e2e-kind.sh builds
|
|
# dsh-aaas-gateway:e2e and overrides this image).
|
|
#
|
|
# SSO IS OPT-IN: this manifest runs the gateway with its own bearer/session
|
|
# auth only, so AUTH_PROXY_HEADER is intentionally NOT set (see the env
|
|
# block). To put GitHub OAuth in front of it, use
|
|
# manifests/exposure/gateway-api-sso/.
|
|
#
|
|
# This Service is ClusterIP and is the only intended entry point: expose it
|
|
# through exactly ONE of the documented variants in manifests/exposure/
|
|
# (ingress/ or gateway-api-sso/), never both and never directly.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
---
|
|
# Least privilege:
|
|
# - claims are created/deleted per user (signup/delete);
|
|
# - sandboxes are read, and patched only to flip operatingMode (suspend/resume);
|
|
# - pods are read, and pods/log is read to capture DSH's launch token from
|
|
# the startup log line (`dsh web: ...?token=...`).
|
|
# configmaps are not needed: all state is in memory / claim annotations.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
rules:
|
|
- apiGroups: ["extensions.agents.x-k8s.io"]
|
|
resources: ["sandboxclaims"]
|
|
verbs: ["get", "list", "create", "delete"]
|
|
- apiGroups: ["agents.x-k8s.io"]
|
|
resources: ["sandboxes"]
|
|
verbs: ["get", "list", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/log"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: dsh-gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
spec:
|
|
# Single replica BY DESIGN: the idle clock, in-flight counters and the
|
|
# per-(user, pod, Host) DSH cookie cache are in-process memory. Running two
|
|
# replicas would fragment that state (double suspend/resume races, repeated
|
|
# log-token handshakes). Scale only after moving state to a shared store.
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: dsh-gateway
|
|
spec:
|
|
serviceAccountName: dsh-gateway
|
|
# OPTIONAL: run the gateway under gVisor. Requires a RuntimeClass named
|
|
# "gvisor" and nodes that can run it. See docs/optional-hardening.md.
|
|
# runtimeClassName: gvisor
|
|
#
|
|
# OPTIONAL: pin the gateway to a dedicated node pool. Replace the
|
|
# placeholder with a label your nodes carry; add a toleration for a
|
|
# tainted pool. Keep active cluster-specific scheduling in a local patch.
|
|
# nodeSelector:
|
|
# dsh.example.com/node-pool: dsh
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10000 # matches USER in gateway/Dockerfile
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: gateway
|
|
image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
env:
|
|
- name: NAMESPACE
|
|
value: dsh-demo
|
|
- name: POOL
|
|
value: dsh-pool
|
|
# Seconds a sandbox may sit idle before the sweeper suspends it
|
|
# (pod deleted, PVC kept), and the max time a proxy request waits
|
|
# for a suspended sandbox to become Ready again. Only claims this
|
|
# gateway created are swept: a claim applied by hand from the
|
|
# resource-layer manifests carries no aaas.example.com/managed-by
|
|
# annotation and is never suspended.
|
|
#
|
|
# These are the demo values (360/240). scripts/e2e-kind.sh
|
|
# overrides both to 60/120 with `kubectl set env` so the smoke
|
|
# test does not wait six minutes for the sweeper.
|
|
- name: IDLE_TIMEOUT
|
|
value: "360"
|
|
- name: WAKE_TIMEOUT
|
|
value: "240"
|
|
# Container name inside the per-user sandbox pods whose logs carry
|
|
# the DSH launch token.
|
|
- name: DSH_CONTAINER
|
|
value: dsh-web
|
|
# Cookie dsh_gw_session is HttpOnly + SameSite=Lax. "false" keeps
|
|
# the plain-HTTP demo usable through port-forward: a Secure cookie
|
|
# is never sent over HTTP, so login would silently fail.
|
|
# HTTPS deployments (the ingress/ variant with TLS, or
|
|
# gateway-api-sso/, which terminates TLS at the Gateway) MUST set
|
|
# this to "true".
|
|
- name: COOKIE_SECURE
|
|
value: "false"
|
|
# SSO IS OPT-IN AND DISABLED HERE. With AUTH_PROXY_HEADER unset the
|
|
# gateway trusts only its own bearer/session auth and ignores every
|
|
# identity header. Enable it ONLY behind
|
|
# manifests/exposure/gateway-api-sso/, where oauth2-proxy is the
|
|
# sole route to this Service: set it to X-Forwarded-User, keep the
|
|
# Service ClusterIP and reachable only through the proxy, and
|
|
# terminate TLS in front of the gateway. Otherwise anyone who can
|
|
# reach :8080 can impersonate any user by sending that header.
|
|
# - name: AUTH_PROXY_HEADER
|
|
# value: X-Forwarded-User
|
|
# Reject proxied request bodies larger than this (413).
|
|
- name: MAX_BODY_MB
|
|
value: "32"
|
|
# /healthz is unauthenticated and returns 200 without touching the
|
|
# cluster, so it is safe for both readiness and liveness.
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: 500m, memory: 256Mi}
|
|
volumeMounts:
|
|
# readOnlyRootFilesystem leaves no writable HOME/tmp; the image sets
|
|
# HOME=/tmp, so back it with scratch space. No state lives here.
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
spec:
|
|
selector:
|
|
app: dsh-gateway
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|