mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
98cb547ae5
Port the upstream hermes-agents-as-a-service example to DSH Web: numbered manifests (00-prereqs .. 50-gateway), a Python gateway (signup, per-user tokens, wake-on-connect proxy, idle suspend), run-test-kind.sh smoke test, and docs. Fix deploy/k8s/sandbox-template.yaml (v1beta1, correct image, volumeClaimTemplates). Add a validate workflow (manifest server dry-run + gateway unit tests). Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
95 lines
2.4 KiB
YAML
95 lines
2.4 KiB
YAML
# The gateway: control+data plane that turns the resources into a usable
|
|
# service. Build the image first (see README step 8):
|
|
# docker build -t dsh-aaas-gateway:demo gateway/
|
|
# kind load docker-image dsh-aaas-gateway:demo # (kind clusters)
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
---
|
|
# Least privilege: claims are created/deleted per user; sandboxes are only
|
|
# read and patched (operatingMode flips for suspend/resume).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
rules:
|
|
- apiGroups: ["extensions.agents.x-k8s.io"]
|
|
resources: ["sandboxclaims"]
|
|
verbs: ["get", "list", "create", "delete"]
|
|
- apiGroups: ["agents.x-k8s.io"]
|
|
resources: ["sandboxes"]
|
|
verbs: ["get", "list", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: dsh-gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
spec:
|
|
replicas: 1 # in-memory idle clock => single replica by design
|
|
selector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: dsh-gateway
|
|
spec:
|
|
serviceAccountName: dsh-gateway
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10000 # matches USER in gateway/Dockerfile
|
|
runAsGroup: 10000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: gateway
|
|
image: dsh-aaas-gateway:demo
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- containerPort: 8080
|
|
env:
|
|
- name: NAMESPACE
|
|
value: dsh-demo
|
|
- name: POOL
|
|
value: dsh-pool
|
|
- name: IDLE_TIMEOUT
|
|
value: "60"
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: 500m, memory: 256Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
spec:
|
|
selector:
|
|
app: dsh-gateway
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|