EislM0203andClaude Opus 4.7
415150c6a3
A new extensions/k8s/ extension giving the agent read-only Kubernetes
tools (k8s_get, k8s_describe, k8s_logs, k8s_events, k8s_top, k8s_explain,
k8s_context). Credentials: KUBE_TOKEN from the env, cluster URL from
KUBE_APISERVER env or ~/.pi/agent/k8s.json (editable via the /k8s panel).
All kubectl invocations go through one exec.ts chokepoint that prepends
--server/--token; the token never reaches any render path. A /k8s panel
runs reachability + can-i probes and lets the user set the cluster URL
(press e). A bundled "k8s" mode restricts the toolset to read + grep +
k8s_* for focused troubleshooting. README ships the SA + RBAC manifest.
Container changes (Dockerfile):
- install kubectl
- bake customizations into /app (OpenShell Landlock allowlists /app,
not /opt) and chmod world-readable so the remapped sandbox uid can
read them
- openshell-policy.yaml: baseline filesystem/landlock/process policy
Also deletes the unused status-line.ts demo extension.
Known limitation: does NOT work inside an OpenShell sandbox yet —
OpenShell hardcodes the k8s control-plane ports (6443 et al.) as
universally blocked in its SSRF engine with no override. Documented in
extensions/k8s/README.md ("Why not OpenShell yet"). The extension works
when pi runs directly on a host with cluster access.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
746 B
YAML
26 lines
746 B
YAML
# Baseline OpenShell sandbox policy for the pi-customizations container.
|
|
#
|
|
# Pi-specific provider endpoints (e.g. the k8s read-only API) come from
|
|
# provider profiles, which auto-emit network_policies entries when the
|
|
# matching provider is attached. See openshell-k8s-profile.yaml.
|
|
#
|
|
# `filesystem_policy` / `landlock` / `process` mirror the OpenShell
|
|
# quickstart defaults; sync if those change upstream.
|
|
#
|
|
# Usage:
|
|
# openshell sandbox create --policy openshell-policy.yaml ...
|
|
|
|
version: 1
|
|
|
|
filesystem_policy:
|
|
include_workdir: true
|
|
read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
|
|
read_write: [/sandbox, /tmp, /dev/null]
|
|
|
|
landlock:
|
|
compatibility: best_effort
|
|
|
|
process:
|
|
run_as_user: sandbox
|
|
run_as_group: sandbox
|