GREEN · RED · BLUE PACKAGE SKILL · DIGITALOCEAN KUBERNETES · NETBIRD AGENT NETWORK · CLAUDE CODE

Agent Network DOKS Package Skill

A reproducible Green, Red, or Blue workflow for a NetBird Agent Network demo on managed Kubernetes: a keyless, policy-gated LLM endpoint on a DOKS cluster — and a two-pod application whose agent can reach nothing but its SOCKS5 leg.

The isolation is the demo — and it is unprivileged. The agent pod runs under restricted Pod Security behind a default-deny NetworkPolicy whose single egress rule is the NetBird client pod: a netstack SOCKS5 listener — userspace WireGuard, no TUN device, no capabilities. Its only path to an LLM is the agent-network endpoint over the tunnel, where the request carries the peer's identity, passes the policy, hits the model allowlist and the budget caps, and lands in the access log — with the Anthropic key held server-side, never in the pod. Acceptance probes the boundary from both sides: raw TCP around the proxy, and CONNECT probes through it.

Quick start

npx skills add getcolors/agent-network-doks
cp .agents/skills/package-agent-network-doks-green/green ./green
chmod +x green
./green build
./green create --dry-run

Build renders reproducible output and dry-run walks the workflow without provider side effects. Real creation and deletion require explicit authorization. Equivalent Red and Blue skills ship red and blue launchers rendering byte-identical output.

Architecture

Explore the interactive architecture diagram for the public edge, gateway namespace, isolated application path, and keyless model access flow.

Compute

One DOKS cluster (managed control plane, single non-HA, one node pool) and a DigitalOcean Container Registry — created and profile-named, or adopted by name (registries are account-scoped and tier-limited). No SSH anywhere: every operation goes through the generated kubeconfig.

DNS & TLS

Two unproxied Cloudflare A records at the load balancer: the base name and its wildcard — the endpoint hostname is a label management mints at bootstrap. One lego DNS-01 order carries both SANs; Traefik terminates the base name from that pair and hands endpoint subdomains to the private reverse proxy over an SNI passthrough with PROXY protocol v2. Nothing runs per-name ACME — the pinned build's responder is defective, and the package routes around it.

Application

Two pods. The NetBird client in netstack/SOCKS5 mode enrolls with a one-off key streamed over exec stdin into memory-backed storage (never a Kubernetes Secret) and keeps its identity on a small CSI volume. The agent pod — headless Claude Code plus a localhost HTTP→SOCKS5 bridge — holds no key, no ServiceAccount token, no DNS. The agent image is built in-cluster by kaniko and consumed by digest.

Acceptance

Isolation probed around and through the SOCKS5 listener, each with a success control; the tunnel up; the keyless call; both denial classes at zero upstream cost; headless Claude Code on the same path; the external pre-identity 403; attribution and limits read back; and a bounded disruption suite — pod deletes, component restarts, a node drain under an uncordon trap — after which the claim is re-probed.

Fake-key mode

A deliberately fake COLORS_PAR_ANTHROPIC_API_KEY is a supported mode: acceptance then expects Anthropic's own 401 relayed through the proxy — proving isolation, the tunnel, endpoint routing, policy authorization and server-side key injection with nothing billable. Swap in a real key and re-run create for real completions.

Exposure

Surface	Exposure	Purpose
80 / 443	`digitalocean-http-sources`, enforced as LB firewall rules	Traefik: dashboard, REST API, gRPC, relay WebSocket, embedded IdP — and the SNI passthrough that hands endpoint TLS to the private reverse proxy
STUN 3478/udp	in-cluster only	Both peers live on the pod network; ICE connects on direct host candidates with the in-cluster relay as fallback. No UDP is ever public.
8443 / 9090 / 9000	closed	The proxy's pod port, metrics and healthcheck — asserted refused at the load balancer

Disposable by design. No backups: recovery is a guarded delete followed by create, which regenerates the endpoint hostname and every peer identity. Nothing in the cluster is worth outliving it.

Safety

Credentials are COLORS_PAR_* variables in the gitignored .envrc.private — never in colors.yml.
Never export COLORS_PAR_PROFILE; the profile keys remote state.
.colors/ is generated output: never edit or commit it.
compute-prevent-destroy: true stays committed; destruction takes a one-run override.

Relation to agent-network-k8s

The Vultr sibling (agent-network-k8s) proved this architecture on VKE; the single-node parent (agent-network) verified the control-plane contract both reuse verbatim. This package changes the provider — DOKS with Cilium-enforced NetworkPolicy (proven by a canary gate before any secret lands), a DigitalOcean Container Registry with adopt-or-create modes, a TCP-mode regional load balancer, and cluster subnets read back from the API rather than supplied — not the claim.

Source on GitHub