Stéphane Tailland
95038942cb
Nothing outside the cluster could talk to it: every conversation went through kubectl run curl, which makes an agent that works and nobody can use. The same authentication subrequest that guards the n8n endpoints guards this one. The agent forwards and exchanges the caller's token, so a forged one fails at the realm — but failing downstream is not refusing, and an unauthenticated caller could still make it do inference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
12 lines
376 B
YAML
12 lines
376 B
YAML
# The `agents` namespace and the sttlab-ca ConfigMap are created by the
|
|
# catalogue agent's repo, which got there first. Declaring them here too
|
|
# would give two Kustomizations the same objects to prune.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- externalsecret.yaml
|
|
- configmap.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- ingress.yaml
|