mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
6301c21bea
* Rewrite DSH gateway for browser sessions, HTTP and WebSocket - Replace the Flask proxy with a Starlette ASGI app (uvicorn factory), keeping the control plane (claims, wake/suspend, idle sweeper). - Add HttpOnly gateway sessions and a server-side DSH launch-token handshake: read the token from pod logs, exchange it for a dsh-auth cookie, cache per (user, pod UID, Host), refresh once on 401. - Proxy HTTP/SSE and WebSocket (/api/remote.mux) under /u/<user>/, with header stripping/injection, Location rewriting and wake-on-connect. - Add a landing/signup/login page, health endpoint, pinned dependencies, a read-only-rootfs gateway image, 87 cluster-free tests and docs. * Fix DSH probe crash-loop and harden gateway manifests - Probe /favicon.svg instead of /: DSH gates / behind its launch-token cookie and returns 401, which made warm-pool pods crash-loop. - Pass DSH_TRUSTED_HOSTS through the entrypoint as --trusted-host args for public/ingress hosts; keep localhost trusted. - Deploy the published :gateway image, add pods/pods-log RBAC, /healthz probes, read-only rootfs with a /tmp emptyDir and non-root security. - Add optional Traefik Ingress and document the prerequisites. * Update CI, smoke tests, build tooling and docs - Run gateway pytest/ruff and build/smoke-test the image in CI. - Parameterize the DSH build version and pnpm version inputs. - Exercise cookie signup, HTML proxy, WebSocket auth, suspend/wake and delete in run-test-kind.sh. - Add Makefile/build.sh targets and document the architecture, handshake, probes, trusted hosts, troubleshooting and limitations. --------- Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
# OPTIONAL browser entry point: expose the gateway through Traefik.
|
|
#
|
|
# Requires 50-gateway.yaml (Service dsh-gateway:8080) and a Traefik install
|
|
# with an IngressClass named "traefik" (k3s ships one). Replace the placeholder
|
|
# host below with a name that resolves to your ingress address, and either
|
|
# supply a real TLS Secret or delete the `tls:` block for plain HTTP.
|
|
#
|
|
# Two things must match this host:
|
|
# 1. SandboxTemplate (10-sandboxtemplate.yaml): set DSH_TRUSTED_HOSTS to
|
|
# this host so DSH accepts the forwarded Host/Origin on /api.
|
|
# 2. Gateway Deployment (50-gateway.yaml): set COOKIE_SECURE to "true"
|
|
# once this Ingress serves HTTPS, so the session cookie is Secure.
|
|
#
|
|
# WebSocket support is REQUIRED: the browser talks to /u/<user>/... and DSH
|
|
# uses WebSockets for live session traffic. Traefik upgrades WS/SSE
|
|
# transparently for ordinary HTTP routers, but do NOT attach buffering
|
|
# middlewares (e.g. compress, buffering) to this router — they break streaming
|
|
# and upgrades. `path: /` Prefix covers the landing page and every per-user
|
|
# proxy path, so no per-sandbox Ingress is needed.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
# Typical Traefik + cert-manager wiring (uncomment and adapt):
|
|
# annotations:
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
annotations: {}
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- dsh.example.com # placeholder
|
|
secretName: dsh-example-tls # placeholder; create/PKI-provision this Secret
|
|
rules:
|
|
- host: dsh.example.com # placeholder
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dsh-gateway
|
|
port:
|
|
number: 8080
|