Stéphane Tailland
9c3bdba3f9
Two-stage Dockerfile: the runtime image carries neither uv nor a build toolchain, runs as uid 10001, drops every capability and needs no writable filesystem (verified with --read-only and no tmpfs). k8s/ is what runs, dev/ is the Flux plumbing that applies it, self-managing after three manual applies — the same shape every kong-* repo settled on. Three choices worth naming: - One namespace for the estate. What isolates an agent is its Keycloak client and the audiences it may request, not a namespace boundary. - The GitRepository uses anonymous HTTPS rather than SSH with a Vault-held deploy key. The repo is already anonymously readable on gitea, so a key would guard nothing while adding two objects to create by hand before anything deploys. If the repos ever go private this becomes the kong-* SSH pattern. - The lab CA certificate is committed. It is a certificate, never a key, and checking it in means the deployment has no hidden prerequisite. replicas: 1 is a constraint, not a default — conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
881 B
YAML
25 lines
881 B
YAML
# The agent's Keycloak client secret, and nothing else. It comes from the same
|
|
# Vault entry the realm import reads, so there is exactly one copy of this
|
|
# secret in the estate and rotating it in Vault rotates it everywhere.
|
|
#
|
|
# vault-keycloak rather than a store of the agents' own: this value is a
|
|
# Keycloak client secret, owned by the realm, and inventing a second AppRole to
|
|
# read the same path would add a credential without adding a boundary.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: catalogue-agent-secrets
|
|
namespace: agents
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: catalogue-agent-secrets
|
|
data:
|
|
- secretKey: CATALOGUE_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_CATALOGUE
|