nicolas-georger/deepseek-kubernetes-sandbox

mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00

Files

SREDevOps.org Agent 14c3fb840e feat(example): add optional failed-Pod recovery (#26 )

agent-sandbox v1.0.8 adds spec.failedPodPolicy to Sandbox and
SandboxTemplate. The default, Retain, leaves a Failed Pod in place and
surfaces Finished=True; Recreate deletes it and starts a replacement with
the same Sandbox identity and PVCs.

Ship it as an opt-in toggle next to the other commented fields, with a
new section 5 in the optional-hardening doc: what it changes, how to
enable it for new, warm-pool and already-claimed Sandboxes (the policy is
stamped at creation), a failure drill, caveats and rollback. The base
walkthrough stays on Retain because a deterministic failure would
otherwise recreate forever, and because the templates use
restartPolicy OnFailure, so the policy only matters for terminal cases
such as node eviction.

Cross-references updated in the example README, the optional-manifests
index, the architecture failure-mode table and the platform skill's
troubleshooting table.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

2026-10-26 14:29:01 -03:00

network-policy

feat(example): add optional gVisor, nodeSelector, NetworkPolicy and provider keys (#21 )

2026-10-26 10:03:30 -03:00

README.md

feat(example): add optional failed-Pod recovery (#26 )

2026-10-26 14:29:01 -03:00

README.md

Optional manifests

Opt-in manifests that are not part of the top-level walkthrough. kubectl apply -f manifests/ is non-recursive, so it does not apply this directory; apply a subdirectory explicitly.

network-policy/

A Kubernetes NetworkPolicy for the DSH sandboxes:

ingress only from the gateway pods on TCP 3080 (HTTP + WebSocket);
egress only to DNS and public HTTPS (provider APIs, package mirrors, git-over-HTTPS).

Apply and delete it explicitly:

kubectl apply -f manifests/optional/network-policy/
kubectl delete -f manifests/optional/network-policy/

It requires a CNI that enforces NetworkPolicy. The selector uses the agent-sandbox controller's pod tracking label, so the policy applies to existing warm-pool and claimed sandboxes without recreation.

gVisor, nodeSelector and provider keys

These are configured in the main manifests or with an extra Secret:

gVisor: uncomment runtimeClassName: gvisor in the SandboxTemplate and the Deployments before applying, or patch an existing install.
nodeSelector: uncomment the field and replace the placeholder node label.
Failed-Pod recovery: uncomment failedPodPolicy: Recreate in the SandboxTemplate (agent-sandbox v1.0.8+) so a Failed Pod is replaced instead of parked.
Provider keys: create the optional dsh-provider-keys-extra Secret; the base dsh-provider-keys Secret remains the one required key.

Full prerequisites, exact commands, verification and caveats: optional hardening.