mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
e6e109d9a9
- the root Dockerfile is the primary artifact; versions.env is the single source of truth
- merge gateway-api/dsh-demo into examples/dsh-agents-as-a-service (manifests/, exposure variants)
- move the single-tenant template into examples/minimal-single-tenant
- publish the gateway as a nested package under the repository image
- mirror the DSH ref for release identities (first release dsh-v0.2.1-rc.2-r2)
- CI: lint/python/manifests/gateway-image, reusable multi-arch build, tag-driven release, weekly e2e
- docs: README, docs/{main-image,examples,gitflow,versioning}, example READMEs, AGENTS.md, governance
- SSO is opt-in again; gateway pull policy and cookie defaults match the documented demo
BREAKING CHANGE: example manifest paths, the gateway image name, and the removal
of deploy/ and gateway-api/ affect existing deployments; see the migration table
in README.md.
40 lines
1.7 KiB
Plaintext
40 lines
1.7 KiB
Plaintext
# EXAMPLE ONLY — do not apply as-is.
|
|
#
|
|
# oauth2-proxy reads its GitHub OAuth credentials and cookie-signing secret from
|
|
# this Secret. Populate real values and apply:
|
|
#
|
|
# kubectl -n dsh-demo create secret generic oauth2-proxy \
|
|
# --from-literal=client-id='<GitHub OAuth App client ID>' \
|
|
# --from-literal=client-secret='<GitHub OAuth App client secret>' \
|
|
# --from-literal=cookie-secret="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
|
|
#
|
|
# The cookie secret must decode (base64) to exactly 16, 24, or 32 bytes.
|
|
# oauth2-proxy base64-decodes it, so it must be URL-safe, unpadded base64.
|
|
# Generate it with either of:
|
|
#
|
|
# python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
|
|
# openssl rand -base64 32 | tr -- '+/' '-_' | tr -d '='
|
|
#
|
|
# Do NOT use plain `openssl rand -base64 32`: that yields 44 characters of
|
|
# standard base64 (with "=" and possibly "+"/"/"), which oauth2-proxy cannot
|
|
# decode and therefore treats as 44 raw bytes, failing with "cookie_secret must
|
|
# be 16, 24, or 32 bytes ... but is 44 bytes".
|
|
#
|
|
# GitHub OAuth App (https://github.com/settings/developers):
|
|
# Homepage URL https://dsh-demo.example.com
|
|
# Authorization callback https://dsh-demo.example.com/oauth2/callback
|
|
# (replace dsh-demo.example.com with the actual public FQDN)
|
|
#
|
|
# NOTE: pass the base64 value as-is via --from-literal (kubectl stores the
|
|
# literal; it does not base64-encode it a second time).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: dsh-demo
|
|
type: Opaque
|
|
stringData:
|
|
client-id: "<github-oauth-app-client-id>"
|
|
client-secret: "<github-oauth-app-client-secret>"
|
|
cookie-secret: "<urlsafe-unpadded-base64-of-32-random-bytes>"
|