mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3e9ba38fc1
Add opt-in hardening to the agents-as-a-service example: - commented runtimeClassName/nodeSelector fields for sandboxes and Deployments - optional sandbox NetworkPolicy plus exposure-variant policies - optional dsh-provider-keys-extra Secret for extra provider keys - docs/optional-hardening.md with verification, caveats and rollback The base walkthrough stays portable; no gateway code, routes or auth changed. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
32 lines
1.0 KiB
YAML
32 lines
1.0 KiB
YAML
# OPTIONAL with the Ingress exposure variant: restrict the gateway's ingress
|
|
# to the ingress controller.
|
|
#
|
|
# This manifest assumes Traefik, matching this variant's
|
|
# `ingressClassName: traefik`. Traefik's Helm chart labels its pods
|
|
# app.kubernetes.io/name=traefik; adjust the selector for another controller or
|
|
# for a hostNetwork install (where the source is the node IP, not a pod IP).
|
|
#
|
|
# NetworkPolicy enforcement of kubelet probe traffic is CNI-dependent. If the
|
|
# gateway starts failing its /healthz probes, allow the node CIDR on port 8080
|
|
# or remove this policy. See ../../../docs/optional-hardening.md.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: dsh-gateway-ingress
|
|
namespace: dsh-demo
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|