Stéphane Tailland
9c3bdba3f9
Two-stage Dockerfile: the runtime image carries neither uv nor a build toolchain, runs as uid 10001, drops every capability and needs no writable filesystem (verified with --read-only and no tmpfs). k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing after three manual applies — the same shape every kong-* repo settled on. Three choices worth naming: - One namespace for the estate. What isolates an agent is its Keycloak client and the audiences it may request, not a namespace boundary. - The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held deploy key. The repo is already anonymously readable on gitea, so a key would guard nothing while adding two objects to create by hand before anything deploys. If the repos ever go private this becomes the kong-* SSH pattern. - The lab CA certificate is committed. It is a certificate, never a key, and checking it in means the deployment has no hidden prerequisite. replicas: 1 is a constraint, not a default — conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.8 KiB
YAML
37 lines
1.8 KiB
YAML
# The lab CA, so the agent can verify keycloak.sttlab.local and every gateway
|
|
# rather than disabling verification. A CA certificate is public by
|
|
# construction — this is the certificate, never the key, and it is checked in
|
|
# deliberately so the deployment has no hidden prerequisite.
|
|
#
|
|
# Issued by the sttlab-local-ca ClusterIssuer, valid until 2026-11-24. When it
|
|
# is rotated this file must be regenerated:
|
|
# kubectl -n cert-manager get secret sttlab-local-ca \
|
|
# -o jsonpath='{.data.tls\.crt}' | base64 -d
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: sttlab-ca
|
|
namespace: agents
|
|
data:
|
|
ca.crt: |
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIDPDCCAiSgAwIBAgIUd/utDf+f0yQR3v3qTjZqx+wvTZMwDQYJKoZIhvcNAQEL
|
|
BQAwGTEXMBUGA1UEAwwOKi5zdHRsYWIubG9jYWwwHhcNMjUxMTI0MTUzODQ1WhcN
|
|
MjYxMTI0MTUzODQ1WjAZMRcwFQYDVQQDDA4qLnN0dGxhYi5sb2NhbDCCASIwDQYJ
|
|
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALj0sryq8qXtkShT/B+/EjVJNN/TLHIn
|
|
QJYc6xuUH/f7q3dYdLm4iH0XnFgrSQLUo4iqd/Mczef5iWCYwT5FFa7P17/TcLVf
|
|
gso0j41qNLBjGxDQGQ6Z1VCxi6oan8ow98rumjVj0E0Qgs5CX/rN+gcEmZ/TZFWU
|
|
qudVoztpeiVqJ0dxCIq+KMutzd1BU7BXx4VRO9Y+t1idUc7oY7BPmS2qPAN7TtXP
|
|
j1KhH2BgLsmF5GRhYHNS578eCltcmS2sbQ3c7GwOV96lpgF9TixEvFXeN4xk43E6
|
|
1COUD7CRiWAZ0XI8FMlpZGeNZeV4bbV/MqVig1ybWNOz9MDKYj3eoXUCAwEAAaN8
|
|
MHowHQYDVR0OBBYEFDbzYWOPr4vxa+VONs7xHbcNx70YMB8GA1UdIwQYMBaAFDbz
|
|
YWOPr4vxa+VONs7xHbcNx70YMA8GA1UdEwEB/wQFMAMBAf8wJwYDVR0RBCAwHoIO
|
|
Ki5zdHRsYWIubG9jYWyCDHN0dGxhYi5sb2NhbDANBgkqhkiG9w0BAQsFAAOCAQEA
|
|
tU4p5/ONXm7x4YDzSeL8NdThVLguiFur0jcTxvvPUS4NFNsnQJk4OXxBgjy1YwpL
|
|
3i56/4mCEd9OCQF/Hl0eFwGZBzNKlMoTA08AC/lBDvPrnVjuUu0qe/b/2KOkhESa
|
|
x8rQNp0o8pcj0f29nu0JfRqYGkzy0Lh2qgXhPu2iC+t2PfdleRAky1tt68wogdFL
|
|
TvHDsJbVo/ihsPpONlSyHfxG6bb/0Mkz64PH46TTt9GvJflEKMqDwivNFUA1P5S/
|
|
U4Ic8Qapnxc7h2+WbRjmYrnuygC2wMBE6rL9OF3gwCr1fkgGGRr5lVRUq2X2HZV5
|
|
5jqViv6eurq8O61N3vWGCQ==
|
|
-----END CERTIFICATE-----
|