Conversation
Co-Authored-By: Claude
|
Hi @sauagarwa. Thanks for your PR. I'm waiting for a validatedpatterns member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
🤖 Wed Sep 30 20:38:34 - The preview is ready at: |
dminnear-rh
left a comment
dminnear-rh
left a comment
There was a problem hiding this comment.
Using the Request Changes in the review just to make sure nobody else merges this.
PR is good to go but we are awaiting review/approval from Nvidia to include them as a partner
laubai
left a comment
laubai
left a comment
There was a problem hiding this comment.
Added a number of review comments; I'd recommend making these changes prior to this content being merged so that they can be approved by the partner before they're published on the site.
| [id="about-secure-agent-workspace-solution"] | ||
| == About the solution | ||
|
|
||
| The {solution-name-upstream} framework installs the operators and shared services, then creates one workspace per user listed in `overrides/saw-users.yaml`: a namespace `saw-<user>`, a {VirtProductName} VM named after the user, the VM's routes, and the inputs its installer reads. |
There was a problem hiding this comment.
I recommend rewriting this slightly for the sake of clarity, e.g.
The {solution-name-upstream} framework installs the Operators and shared services, then creates one workspace per user listed in `overrides/saw-users.yaml`. Each workspace contains the following:
* a namespace, `saw-<user>`
* a {VirtProductName} VM named after the user
* routes for the user VM
* inputs to the VM installer
| An enterprise-ready Kubernetes container platform built for an open hybrid cloud strategy. It provides a consistent application platform to manage hybrid cloud, public cloud, and edge deployments. | ||
|
|
||
| https://www.redhat.com/en/technologies/cloud-computing/openshift/virtualization[Red{nbsp}Hat {VirtProductName}]:: | ||
| Runs virtual machines alongside containers on {ocp}. This pattern runs one workspace VM per user, cloned from a golden image. {VirtProductName} needs bare-metal worker nodes. |
There was a problem hiding this comment.
Rather than "golden image", it might be useful to be more explicit, e.g. cloned from a template image with a known, stable configuration.
Also, probably better to use requires rather than needs in the final sentence.
| * *VM isolation:* one VM per user, so no agent shares a kernel or process space with another user's agents. | ||
| * *Identity:* users sign in to Keycloak with OIDC. The OpenShell gateway in each VM accepts only tokens for its realm and maps Keycloak roles to OpenShell roles. | ||
| * *Governance:* every sandbox and provider change goes through a governance interceptor that serves a signed sandbox policy and the approved provider profiles. Policy changes are made in Git. | ||
| * *Credentials:* API keys are stored in {hashicorp-vault} and reach the user's namespace through the {eso}. Inside a sandbox the agent sees only a placeholder. The sandbox's egress proxy substitutes the real key, and only for the hosts and programs the provider profile allows. |
There was a problem hiding this comment.
Minor fix to avoid anthropomorphism:
Inside a sandbox, the agent receives only a placeholder.
Minor clarity fix:
The sandbox's egress proxy substitutes the real key, but only for the hosts and programs that the provider profile allows.
| The AI agents that run in the sandboxes, with a terminal UI and a web UI. | ||
|
|
||
| https://build.nvidia.com/[NVIDIA models on build.nvidia.com]:: | ||
| The default model provider (NVIDIA Nemotron). Any OpenAI-compatible endpoint, such as vLLM or Ollama on the cluster, can be used instead. |
There was a problem hiding this comment.
Fix to avoid passive voice:
You can use any OpenAI-compatible endpoint on the cluster instead, such as vLLM or Ollama.
| [id="about-secure-agent-workspace"] | ||
| = About the Secure Agent Workspace pattern | ||
|
|
||
| Give each user an isolated AI agent workspace on {rh-ocp}: a dedicated virtual machine that runs NVIDIA OpenShell and its agent sandboxes, with single sign-on, centrally governed sandbox policy, and API keys that never enter the agent's environment. |
There was a problem hiding this comment.
Suggest breaking this up a little to make it easier to read:
The Secure Agent Workspace Validated Pattern creates isolated AI agent workspaces on {rh-ocp} for each user. Each workspace contains a dedicated virtual machine that runs NVIDIA OpenShell and its agent sandboxes. Workspaces are consistent and secure, with single sign-on (SSO), centrally governed sandbox policy, and API keys that never enter the agent environment.
| - data-science | ||
| # Optional: | ||
| vaultPrefix: secret/data/hub/saw-bob # bob's own API keys in Vault | ||
| ownerSubject: <Keycloak subject> # from `openshell whoami` after bob's first sign-in |
| Use this page to diagnose common issues when you deploy or use this pattern. Most commands take the user's name as `OPENSHELL_SAW_NAME`; the examples use `alice`. | ||
|
|
||
| [id="troubleshooting-vm-saw"] | ||
| == The workspace VM does not start |
There was a problem hiding this comment.
These headings should probably be === rather than ==
| @@ -0,0 +1,129 @@ | |||
| --- | |||
| title: Troubleshooting | |||
There was a problem hiding this comment.
If possible, it would be good to put all of these sections into the same symptom / cause / resolution format - there are four with this structure, and four without.
| With OpenShell 0.1.x, a provider profile that carries more than one annotation makes the gateway compute a different provider revision on every request (link:https://github.com/NVIDIA/OpenShell/issues/3929[NVIDIA/OpenShell#3929]). The governance interceptor that this pattern builds keeps only one annotation per profile. An interceptor built without that change, or from another OpenShell release, causes this error. | ||
|
|
||
| Resolution:: | ||
| Check that the governance interceptor runs the image the chart sets, built from the same OpenShell release as the gateways: |
There was a problem hiding this comment.
A little confusing, tried to rewrite:
Check that the governance interceptor runs the image defined in the chart, and that the image and gateways are built using the same OpenShell release.
There was a problem hiding this comment.
We can omit the "Flow" key from the diagram since it is replicated in the page text.
| + | ||
| The browser UI opens through an SSH tunnel on `http://localhost:28789`. | ||
|
|
||
| . Open the OpenShell web UI, which lists the user's workspaces and sandboxes: |
There was a problem hiding this comment.
Can we have give an example prompt that demonstrates the policy in effect? something like
"Use your terminal tool to run curl -sS --max-time 10 https://api.github.com/zen. Show the command and its exact output. "
Then view the denial:
openshell --gateway alice --workspace default
logs notebook --since 5m --source sandbox
Github access is not enabled in the policy so it should be blocked
This branch has not been deployed
5 participants
Adds documentation for the Secure Agent Workspace pattern
(https://github.com/validatedpatterns-sandbox/secure-agent-workspace) as a sandbox-tier pattern.
The pattern gives each user an isolated AI agent workspace in their own OpenShift Virtualization VM, running NVIDIA OpenShell and OpenClaw agents with Keycloak OIDC sign-in, a governed sandbox policy, and API keys kept in Vault.
Pages
_index.adoc– overview and architecture (diagram, numbered flows, shared services, per-user workspace, default profile)getting-started.adoc– prerequisites, preparation, deployment, verification, accessing a workspacecluster-sizing.adoc– bare-metal requirement, per-component resources, example cluster, storage, model servingideas-for-customization.adoc– users, SAW-BOM profiles, model provider, governance policy, OpenShell upgradestroubleshooting.adoc– VM scheduling, installer, sandbox, interceptor, egress, CLI, web UI, Argo CDAlso added
modules/secure-agent-workspace-about.adoc,modules/secure-agent-workspace-architecture.adocmodules/secure-agent-workspace/metadata-secure-agent-workspace.adocstatic/images/secure-agent-workspace/saw-architecture.{png,svg}Notes