feat(poimen): pi sandbox workspace volume, encrypted api keys, cluster dns rewrite #54

2026-10-06T01:47:21Z

rock commented

2026-10-06 01:47:21 +00:00

Adds the pi coding-agent sandbox's cluster side:

k8s/infra/poimen/pi-agent-workspace-pv.yaml — static hostPath PV + PVC for the sandbox /workspace (Longhorn cannot attach new volumes in this cluster; this gives real persistence and survived a pod delete/recreate test: marker file + 38 KB session.jsonl intact, the session answered from its own history afterwards).
k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml — the sandbox's API-key Secret, SOPS-encrypted (recipient from .sops.yaml, payload only: encrypted_regex ^(data|stringData)$), registered in the ksops generator. Round-trip verified against the live Secret.
terraform/files/coredns/Corefile — rewrite name pi.riotpiao.com ingress-nginx-controller... so the hostname resolves in-cluster.

Note: the keys currently in that Secret are the ones leaked earlier and must be rotated; re-encrypt with sops -e -i after rotating.

Adds the pi coding-agent sandbox's cluster side: - `k8s/infra/poimen/pi-agent-workspace-pv.yaml` — static hostPath PV + PVC for the sandbox /workspace (Longhorn cannot attach new volumes in this cluster; this gives real persistence and survived a pod delete/recreate test: marker file + 38 KB session.jsonl intact, the session answered from its own history afterwards). - `k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml` — the sandbox's API-key Secret, SOPS-encrypted (recipient from .sops.yaml, payload only: `encrypted_regex ^(data|stringData)$`), registered in the ksops generator. Round-trip verified against the live Secret. - `terraform/files/coredns/Corefile` — `rewrite name pi.riotpiao.com ingress-nginx-controller...` so the hostname resolves in-cluster. Note: the keys currently in that Secret are the ones leaked earlier and must be rotated; re-encrypt with `sops -e -i` after rotating.

rock added 1 commit 2026-10-06 01:47:22 +00:00

feat(poimen): add pi sandbox workspace volume, encrypted api keys and cluster dns rewrite 5bc7da0f04

rock merged commit b6e317b34c into main

2026-10-06 01:49:19 +00:00

rock deleted branch chore/pi-sandbox-entrypoint

2026-10-06 01:49:21 +00:00

rock referenced this issue from a commit

2026-10-06 02:05:52 +00:00

Merge origin/main into fix/secrets-placeholders (rebuild ksops file list, fix #54 indent)

Sign in to join this conversation.