README
¶
agent-sandbox-examples
The reference deployment for running an agent in a Kubernetes sandbox whose outbound HTTPS the Keycard egress proxy mediates.
Development
The pinned tools install with mise:
mise install
To try the sandbox, run:
go run ./cmd/sandbox up
It asks for what it needs, then sets up a local k3d cluster against your
Keycard zone. It also needs Docker, from OrbStack or Docker Desktop.
docs/local.md describes each step.
Run every gate CI runs:
make all
AGENTS.md describes how work gets into the repository.
License
Apache-2.0 — see LICENSE and, for the copyright notice, NOTICE. The Keycard name and logo are trademarks; TRADEMARKS.md states how they may be used.
Documentation
¶
Overview ¶
Package agentsandboxexamples is the root of the reference deployment for running an agent in a Kubernetes sandbox whose outbound HTTPS the Keycard egress proxy mediates.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
new-sandbox
command
Command new-sandbox creates one sandbox for one user.
|
Command new-sandbox creates one sandbox for one user. |
|
sandbox
command
Command sandbox runs the sandbox demo: an agent in a Kubernetes sandbox whose HTTPS goes through the Keycard egress proxy.
|
Command sandbox runs the sandbox demo: an agent in a Kubernetes sandbox whose HTTPS goes through the Keycard egress proxy. |
|
zone-setup
command
Command zone-setup configures a Keycard zone for the sandboxes from a values file.
|
Command zone-setup configures a Keycard zone for the sandboxes from a values file. |
|
internal
|
|
|
chart
Package chart renders a Helm chart with `helm template`, so a test can pin what the chart says about a cluster without a cluster.
|
Package chart renders a Helm chart with `helm template`, so a test can pin what the chart says about a cluster without a cluster. |
|
install
Package install installs the agent-sandbox controller, then the keycard-sandbox chart, into a cluster.
|
Package install installs the agent-sandbox controller, then the keycard-sandbox chart, into a cluster. |
|
issuer
Package issuer publishes and verifies a cluster's ServiceAccount issuer: its OIDC discovery document and the JWKS that document names.
|
Package issuer publishes and verifies a cluster's ServiceAccount issuer: its OIDC discovery document and the JWKS that document names. |
|
newsandbox
Package newsandbox renders the sandbox chart for one user and applies the result with kubectl.
|
Package newsandbox renders the sandbox chart for one user and applies the result with kubectl. |
|
pinned
Package pinned runs the external tools that the repository's mise.toml pins.
|
Package pinned runs the external tools that the repository's mise.toml pins. |
|
preflight
Package preflight refuses a rendered sandbox manifest it cannot vouch for.
|
Package preflight refuses a rendered sandbox manifest it cannot vouch for. |
|
sandbox
Package sandbox sets up the sandbox demo against a Keycard zone, on a local k3d cluster or an existing one.
|
Package sandbox sets up the sandbox demo against a Keycard zone, on a local k3d cluster or an existing one. |
|
tui/component
Package component draws the parts the TUI's screens share, and keeps the state of the ones that have any: a pane with a border, the log pane with every log, a list to choose from, the key hints, the header band and the footer.
|
Package component draws the parts the TUI's screens share, and keeps the state of the ones that have any: a pane with a border, the log pane with every log, a list to choose from, the key hints, the header band and the footer. |
|
tui/proxylog
Package proxylog reads the egress proxy's log, which holds one JSON audit record for each decision the proxy makes.
|
Package proxylog reads the egress proxy's log, which holds one JSON audit record for each decision the proxy makes. |
|
tui/style
Package style holds the TUI's colors and the styles made from them, and draws the Keycard mark.
|
Package style holds the TUI's colors and the styles made from them, and draws the Keycard mark. |
|
zonesetup
Package zonesetup reads the values file zone-setup configures a zone from and resolves that zone through the management API.
|
Package zonesetup reads the values file zone-setup configures a zone from and resolves that zone through the management API. |
Click to show internal directories.
Click to hide internal directories.