mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
9466449f84
The preflight is the documented gate before real SSO traffic, but it did not check two things the dsh-demo install got wrong: - The gateway Role must grant `patch` on extensions.agents.x-k8s.io/sandboxclaims. The SSO landing path rotates the claim's token-hash annotation whenever the browser has no valid gateway session (first visit, expired or foreign cookie, gateway restart), so a missing verb makes every such sign-in answer 503. Verify with `kubectl auth can-i --as`; when a read-only kubeconfig cannot impersonate, fall back to reading the rules of the Role (or ClusterRole) the RoleBinding points at. - The variant's NetworkPolicies must be applied. Without them any Pod in the cluster can reach dsh-gateway:8080 and spoof X-Forwarded-User, so the exposure is demo-only. Fail the preflight while either policy from 75-networkpolicies.yaml is missing. Also fix a false positive in the cookie-secret check: oauth2-proxy accepts 16, 24 or 32 raw bytes, or URL-safe unpadded base64 that decodes to one of those lengths (pkg/encryption.SecretBytes). The documented `secrets.token_urlsafe(32)` value is 43 base64 characters that decode to 32 bytes, so it is valid and must not be reported as 43 raw bytes. The docs that enumerate the preflight checks are updated to match, and 75-networkpolicies.yaml notes that the preflight enforces it. Verified with shellcheck, yamllint, make check and the gateway test suite (150 passed); the new checks were exercised read-only against the live dsh-demo cluster. Entire-Checkpoint: 01M6FNY2WTC4GMAJ8BAHABN88M Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
Examples
Every implementation in this repository is a self-contained example: one
directory, plain kubectl, an end-to-end README, and a cleanup command.
Examples consume the main DSH Web image; they are
reference material, not libraries.
| Example | What it demonstrates | Needs |
|---|---|---|
examples/dsh-agents-as-a-service/ |
The full multi-tenant platform pattern: one SandboxTemplate with per-user PVCs, a warm pool, one ~10-line SandboxClaim per user, suspend-when-idle / wake-on-return, and a browser gateway with signup, HttpOnly sessions, an HTTP + WebSocket proxy and two exposure variants (Ingress, or Gateway API + GitHub SSO). |
agent-sandbox with extensions; kind for the e2e script. |
examples/minimal-single-tenant/ |
The smallest useful setup: a single SandboxTemplate and one SandboxClaim, no gateway — reach DSH Web with a launch-token URL through kubectl port-forward. |
agent-sandbox with extensions. |
The multi-tenant example also documents opt-in gVisor, nodeSelector,
NetworkPolicy, extra provider-key hardening and failed-Pod recovery in
optional hardening.
The example contract (short version)
Full rules: docs/examples.md. scripts/check-examples.sh
enforces the layout, and make check runs it.
README.mdis the walkthrough;manifests/NN-*.yamlis applied with plain kubectl and read in order.- Optional
manifests/optional/<feature>/andmanifests/exposure/<variant>/each ship a README; exposure variants are mutually exclusive. - Optional
scripts/must be executable, idempotent and self-cleaning;docs/holds deeper material. - Components with a Dockerfile need a README and tests; images are published
nested below the main image (
<registry>/<owner>/<repo>/<example>/<component>). - Secrets are
*.yaml.examplewith placeholders; every example is listed above with its literalexamples/<name>/path.
Running an example
Each example README has the exact prerequisites, commands, optional hardening, exposure options and teardown. The multi-tenant example also has a full kind walkthrough that cleans up after itself:
examples/dsh-agents-as-a-service/scripts/e2e-kind.sh
kubectl apply -f manifests/ is non-recursive: optional/ and exposure/
subdirectories are applied explicitly.