mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
57 lines
2.3 KiB
YAML
57 lines
2.3 KiB
YAML
# OPTIONAL browser entry point: expose the gateway through Traefik.
|
|
#
|
|
# This is the "no SSO" exposure variant and is MUTUALLY EXCLUSIVE with
|
|
# ../gateway-api-sso/ — apply exactly one of them (see ../README.md).
|
|
#
|
|
# Requires the base manifests (Service dsh-gateway:8080 from
|
|
# manifests/50-gateway.yaml) and a Traefik install with an IngressClass named
|
|
# "traefik" (k3s ships one). Replace the placeholder host below with a name
|
|
# that resolves to your ingress address, and either supply a real TLS Secret or
|
|
# delete the `tls:` block for plain HTTP.
|
|
#
|
|
# Two things must match this host:
|
|
# 1. SandboxTemplate (manifests/10-sandboxtemplate.yaml): set
|
|
# DSH_TRUSTED_HOSTS to this host so DSH accepts the forwarded Host/Origin
|
|
# on /api.
|
|
# 2. Gateway Deployment (manifests/50-gateway.yaml): set COOKIE_SECURE to
|
|
# "true" once this Ingress serves HTTPS, so the session cookie is Secure.
|
|
# The base manifest sets "false" for the plain-HTTP port-forward demo.
|
|
#
|
|
# WebSocket support is REQUIRED: the browser talks to /u/<user>/... and DSH
|
|
# uses WebSockets for live session traffic. Traefik upgrades WS/SSE
|
|
# transparently for ordinary HTTP routers, but do NOT attach buffering
|
|
# middlewares (e.g. compress, buffering) to this router — they break streaming
|
|
# and upgrades. `path: /` Prefix covers the landing page and every per-user
|
|
# proxy path, so no per-sandbox Ingress is needed.
|
|
#
|
|
# 61-networkpolicy.yaml is part of this variant: it restricts the gateway's
|
|
# ingress to Traefik pods. Adjust its selector if your ingress controller uses
|
|
# a different label or hostNetwork.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
# Typical Traefik + cert-manager wiring (uncomment and adapt):
|
|
# annotations:
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
annotations: {}
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- dsh.example.com # placeholder
|
|
secretName: dsh-example-tls # placeholder; create/PKI-provision this Secret
|
|
rules:
|
|
- host: dsh.example.com # placeholder
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dsh-gateway
|
|
port:
|
|
number: 8080
|