feat: add agent boundaries, network policy, agent stub, dockerfile, CI

- AGENT_BOUNDARIES.md: egress allow-list, FS scope, approved/forbidden ops - agent-policy.yaml: k8s NetworkPolicy scoping egress to LiteLLM/brain-mcp/ gitea-mcp/OTLP + default-deny baseline - internal/agent/agent.go: thin ADK runner wrapper (Config + Run) - Dockerfile: distroless multi-stage build, entrypoint cmd/__PROJECT_NAME__ - .gitea/workflows/cd.yml: check → buildah build/push → GitOps deploy Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-28 20:54:04 +02:00
parent 7dfe8a792e
commit b9c64c2694
5 changed files with 377 additions and 0 deletions
@@ -0,0 +1,101 @@
+# NetworkPolicy for __PROJECT_NAME__.
+#
+# Pairs with AGENT_BOUNDARIES.md. Egress is allow-listed: LiteLLM, brain-mcp,
+# gitea-mcp, OTLP collector, in-cluster DNS. Everything else is denied.
+#
+# Apply in the __PROJECT_NAME__ namespace. Substitute __PROJECT_NAME__ at
+# render time (envsubst, kustomize replacement, or sed in CI).
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: __PROJECT_NAME__-egress
+  namespace: __PROJECT_NAME__
+  labels:
+    app.kubernetes.io/name: __PROJECT_NAME__
+    app.kubernetes.io/component: agent
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: __PROJECT_NAME__
+  policyTypes:
+    - Egress
+  egress:
+    # In-cluster DNS — required for resolving any of the endpoints below.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+
+    # LiteLLM — model inference proxy.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: litellm
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: litellm
+      ports:
+        - protocol: TCP
+          port: 4000
+
+    # Brain MCP — knowledge base query/write.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingestion
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: brain-mcp
+      ports:
+        - protocol: TCP
+          port: 8080
+
+    # Gitea MCP — repo/issue/PR access.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: gitea
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: gitea-mcp
+      ports:
+        - protocol: TCP
+          port: 8080
+
+    # OTLP — trace export to Jaeger collector.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: observability
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: jaeger
+      ports:
+        - protocol: TCP
+          port: 4318
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: __PROJECT_NAME__-default-deny
+  namespace: __PROJECT_NAME__
+  labels:
+    app.kubernetes.io/name: __PROJECT_NAME__
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: __PROJECT_NAME__
+  policyTypes:
+    - Ingress
+    - Egress
+  # Empty rules = deny-all. The allow-list above is additive on Egress.
+  # Ingress stays denied unless a sibling policy opens specific ports.