mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
14c3fb840e
agent-sandbox v1.0.8 adds spec.failedPodPolicy to Sandbox and SandboxTemplate. The default, Retain, leaves a Failed Pod in place and surfaces Finished=True; Recreate deletes it and starts a replacement with the same Sandbox identity and PVCs. Ship it as an opt-in toggle next to the other commented fields, with a new section 5 in the optional-hardening doc: what it changes, how to enable it for new, warm-pool and already-claimed Sandboxes (the policy is stamped at creation), a failure drill, caveats and rollback. The base walkthrough stays on Retain because a deterministic failure would otherwise recreate forever, and because the templates use restartPolicy OnFailure, so the policy only matters for terminal cases such as node eviction. Cross-references updated in the example README, the optional-manifests index, the architecture failure-mode table and the platform skill's troubleshooting table. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
41 lines
1.5 KiB
Markdown
41 lines
1.5 KiB
Markdown
# Optional manifests
|
|
|
|
Opt-in manifests that are **not** part of the top-level walkthrough.
|
|
`kubectl apply -f manifests/` is non-recursive, so it does not apply this
|
|
directory; apply a subdirectory explicitly.
|
|
|
|
## network-policy/
|
|
|
|
A Kubernetes `NetworkPolicy` for the DSH sandboxes:
|
|
|
|
- ingress only from the gateway pods on TCP `3080` (HTTP + WebSocket);
|
|
- egress only to DNS and public HTTPS (provider APIs, package mirrors,
|
|
git-over-HTTPS).
|
|
|
|
Apply and delete it explicitly:
|
|
|
|
```bash
|
|
kubectl apply -f manifests/optional/network-policy/
|
|
kubectl delete -f manifests/optional/network-policy/
|
|
```
|
|
|
|
It requires a CNI that enforces `NetworkPolicy`. The selector uses the
|
|
agent-sandbox controller's pod tracking label, so the policy applies to
|
|
existing warm-pool and claimed sandboxes without recreation.
|
|
|
|
## gVisor, nodeSelector and provider keys
|
|
|
|
These are configured in the main manifests or with an extra Secret:
|
|
|
|
- **gVisor:** uncomment `runtimeClassName: gvisor` in the SandboxTemplate and
|
|
the Deployments before applying, or patch an existing install.
|
|
- **nodeSelector:** uncomment the field and replace the placeholder node label.
|
|
- **Failed-Pod recovery:** uncomment `failedPodPolicy: Recreate` in the
|
|
SandboxTemplate (agent-sandbox v1.0.8+) so a Failed Pod is replaced instead
|
|
of parked.
|
|
- **Provider keys:** create the optional `dsh-provider-keys-extra` Secret; the
|
|
base `dsh-provider-keys` Secret remains the one required key.
|
|
|
|
Full prerequisites, exact commands, verification and caveats:
|
|
[optional hardening](../../docs/optional-hardening.md).
|