GREEN · RED · BLUE PACKAGE SKILL · VULTR KUBERNETES ENGINE · NETBIRD AGENT NETWORK · CLAUDE CODE

Agent Network K8s Package Skill

A reproducible Green, Red, or Blue workflow for a NetBird Agent Network demo on managed Kubernetes: a keyless, policy-gated LLM endpoint on a VKE cluster — and a two-pod application whose agent can reach nothing but its SOCKS5 leg.

The isolation is the demo — and it is unprivileged. The agent pod runs under restricted Pod Security behind a default-deny NetworkPolicy whose single egress rule is the NetBird client pod: a netstack SOCKS5 listener — userspace WireGuard, no TUN device, no capabilities. Its only path to an LLM is the agent-network endpoint over the tunnel, where the request carries the peer's identity, passes the policy, hits the model allowlist and the budget caps, and lands in the access log — with the Anthropic key held server-side, never in the pod. Acceptance probes the boundary from both sides: raw TCP around the proxy, and CONNECT probes through it.

Quick start

npx skills add getcolors/agent-network-k8s
cp .agents/skills/package-agent-network-k8s-green/green ./green
chmod +x green
./green build
./green create --dry-run

Build renders reproducible output and dry-run walks the workflow without provider side effects. Real creation and deletion require explicit authorization. Equivalent Red and Blue skills ship red and blue launchers rendering byte-identical output.

Architecture

Compute

One VKE cluster (managed control plane, one node pool) and a deployment-owned Vultr Container Registry, both named after the profile. No SSH anywhere: every operation goes through the generated kubeconfig.

DNS & TLS

Two unproxied Cloudflare A records at the load balancer: the base name and its wildcard — the endpoint hostname is a label management mints at bootstrap. One lego DNS-01 order carries both SANs; Traefik terminates the base name from that pair and hands endpoint subdomains to the private reverse proxy over an SNI passthrough with PROXY protocol v2. Nothing runs per-name ACME — the pinned build's responder is defective, and the package routes around it.

Application

Two pods. The NetBird client in netstack/SOCKS5 mode enrolls with a one-off key streamed over exec stdin into memory-backed storage (never a Kubernetes Secret) and keeps its identity on a small CSI volume. The agent pod — headless Claude Code plus a localhost HTTP→SOCKS5 bridge — holds no key, no ServiceAccount token, no DNS. The agent image is built in-cluster by kaniko and consumed by digest.

Acceptance

Isolation probed around and through the SOCKS5 listener, each with a success control; the tunnel up; the keyless call; both denial classes at zero upstream cost; headless Claude Code on the same path; the external pre-identity 403; attribution and limits read back; and a bounded disruption suite — pod deletes, component restarts, a node drain under an uncordon trap — after which the claim is re-probed.

Fake-key mode

A deliberately fake COLORS_PAR_ANTHROPIC_API_KEY is a supported mode: acceptance then expects Anthropic's own 401 relayed through the proxy — proving isolation, the tunnel, endpoint routing, policy authorization and server-side key injection with nothing billable. Swap in a real key and re-run create for real completions.

Exposure

Surface	Exposure	Purpose
80 / 443	`vultr-http-sources`, via the load balancer	Traefik: dashboard, REST API, gRPC, relay WebSocket, embedded IdP — and the SNI passthrough that hands endpoint TLS to the private reverse proxy
STUN 3478/udp	in-cluster only	Both peers live on the pod network; ICE connects on direct host candidates with the in-cluster relay as fallback. No UDP is ever public.
8443 / 9090 / 9000	closed	The proxy's pod port, metrics and healthcheck — asserted refused at the load balancer

Disposable by design. No backups: recovery is a guarded delete followed by create, which regenerates the endpoint hostname and every peer identity. Nothing in the cluster is worth outliving it.

Safety

Credentials are COLORS_PAR_* variables in the gitignored .envrc.private — never in colors.yml.
Never export COLORS_PAR_PROFILE; the profile keys remote state.
.colors/ is generated output: never edit or commit it.
compute-prevent-destroy: true stays committed; destruction takes a one-run override.

Relation to agent-network

The single-node parent (agent-network) verified the control-plane contract this package reuses verbatim. This package changes the substrate and the isolation mechanism — Kubernetes NetworkPolicy instead of Docker networks and DOCKER-USER rules, an unprivileged SOCKS5 leg instead of a kernel TUN — not the claim.

Source on GitHub