mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5.5
137c6c8ed5
Agent Substrate's egress gateway denies an actor without an EgressPolicy, so no task could deliver its artifacts or reach a model. egress.py grants each task exactly: http/80 to ousast-receiver.ax-system.svc.cluster.local, and TLS passthrough/443 to the bound Workspaces' https Git hosts and the bound Model's openultrasast.io/egress-hosts (api.deepseek.com for deepseek-flash). No IPs, no wildcards, no https (MITM) rules. The reconciler writes the policy with kubectl-ate between ax apply and resume, reads it back, waits OUSAST_EGRESS_SETTLE (11 s, the gateway's cached deny), and after ax delete task confirms the policy went with its actor (kubectl-ate has no delete verb; the store cascades). The receiver is a selector-less Service (ops/ax/receiver-service.yaml.tmpl, applied by up.sh together with the no-build agentgateway egress gateway) on port 18090 of the host. Measured live: the gateway checks the policy on Host but connects to the address the actor dialled, so the runner dials the Service's ClusterIP (OUSAST_ARTIFACT_DIAL) with the receiver's name as Host. The runner now labels its delivery with the Run's task name (OUSAST_TASK), which is what the receiver accepts; the ax Task name was refused with 403. The Receiver moved to egress.py to keep reconciler.py at 460 lines. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
24 lines
1019 B
YAML
24 lines
1019 B
YAML
# The chat model of the first increment (ai-service-plane Req 1.1, 1.4, 7.1). `deepseek` is not an ax provider;
|
|
# the annotation declares the extension instead of hiding it in another field. `secretKey` names the Kubernetes
|
|
# Secret and key that hold DEEPSEEK_API_KEY, the variable `tool_hunter.resolve_hunter_client()` reads; the key
|
|
# itself is never in a manifest. Prices are `openultrasast.model.endpoint`'s for `deepseek-flash` (USD per million
|
|
# tokens); the verify task's meter reads them from OUSAST_MODEL_PARAMS with `budget.prices_from`.
|
|
apiVersion: ax.io/v1alpha1
|
|
kind: Model
|
|
metadata:
|
|
name: deepseek-flash
|
|
atespace: default
|
|
annotations:
|
|
openultrasast.io/provider-extension: "true"
|
|
openultrasast.io/egress-hosts: "api.deepseek.com" # model.endpoint.DEEPSEEK_BASE_URL; the task's only model egress
|
|
spec:
|
|
provider: deepseek
|
|
model: deepseek-flash
|
|
secretKey:
|
|
name: deepseek
|
|
key: DEEPSEEK_API_KEY
|
|
parameters:
|
|
cache_hit_per_m: 0.014
|
|
input_per_m: 0.44
|
|
output_per_m: 1.32
|