mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
1.4 KiB
1.4 KiB
Optional manifests
Opt-in manifests that are not part of the top-level walkthrough.
kubectl apply -f manifests/ is non-recursive, so it does not apply this
directory; apply a subdirectory explicitly.
network-policy/
A Kubernetes NetworkPolicy for the DSH sandboxes:
- ingress only from the gateway pods on TCP
3080(HTTP + WebSocket); - egress only to DNS and public HTTPS (provider APIs, package mirrors, git-over-HTTPS).
Apply and delete it explicitly:
kubectl apply -f manifests/optional/network-policy/
kubectl delete -f manifests/optional/network-policy/
It requires a CNI that enforces NetworkPolicy. The selector uses the
agent-sandbox controller's pod tracking label, so the policy applies to
existing warm-pool and claimed sandboxes without recreation.
gVisor, nodeSelector and provider keys
These are configured in the main manifests or with an extra Secret:
- gVisor: uncomment
runtimeClassName: gvisorin the SandboxTemplate and the Deployments before applying, or patch an existing install. - nodeSelector: uncomment the field and replace the placeholder node label.
- Provider keys: create the optional
dsh-provider-keys-extraSecret; the basedsh-provider-keysSecret remains the one required key.
Full prerequisites, exact commands, verification and caveats: optional hardening.