Agentswarm/k8s/test-namespace.yaml

# Test namespace and RBAC for HeiCode-Swarm testing
# Provides isolation and resource limits for test runs

---
# Test namespace
apiVersion: v1
kind: Namespace
metadata:
  name: heicode-swarm-test
  labels:
    environment: test
    purpose: agent-testing

---
# Resource quota to prevent runaway tests
apiVersion: v1
kind: ResourceQuota
metadata:
  name: test-resource-quota
  namespace: heicode-swarm-test
spec:
  hard:
    # Limit total pods to prevent cluster overload
    pods: "25"
    # CPU limits (enough for 20 agents + orchestrator + redis)
    requests.cpu: "22"
    limits.cpu: "25"
    # Memory limits
    requests.memory: "44Gi"
    limits.memory: "50Gi"
    # Storage limits
    persistentvolumeclaims: "5"
    requests.storage: "10Gi"

---
# Limit range for individual pods
apiVersion: v1
kind: LimitRange
metadata:
  name: test-limit-range
  namespace: heicode-swarm-test
spec:
  limits:
  # Default limits for containers
  - type: Container
    default:
      cpu: "1"
      memory: "2Gi"
    defaultRequest:
      cpu: "500m"
      memory: "1Gi"
    max:
      cpu: "2"
      memory: "4Gi"
    min:
      cpu: "100m"
      memory: "128Mi"
  # Pod limits
  - type: Pod
    max:
      cpu: "2"
      memory: "4Gi"

---
# ServiceAccount for test orchestrator
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-orchestrator-sa
  namespace: heicode-swarm-test
  labels:
    component: orchestrator
    environment: test

---
# Role for orchestrator pod management
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: test-orchestrator-role
  namespace: heicode-swarm-test
  labels:
    component: orchestrator
    environment: test
rules:
# Pod management permissions
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
# Pod logs access
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "list"]
# Pod exec for debugging (test only)
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]
# ConfigMaps for agent configuration
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
# Secrets for API keys
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
# Services for orchestrator/redis
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list", "watch"]

---
# RoleBinding to grant orchestrator permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-orchestrator-rolebinding
  namespace: heicode-swarm-test
  labels:
    component: orchestrator
    environment: test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-orchestrator-role
subjects:
- kind: ServiceAccount
  name: test-orchestrator-sa
  namespace: heicode-swarm-test

---
# ServiceAccount for test agents
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-agent-sa
  namespace: heicode-swarm-test
  labels:
    component: agent
    environment: test

---
# Role for agent pods (minimal permissions)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: test-agent-role
  namespace: heicode-swarm-test
  labels:
    component: agent
    environment: test
rules:
# Agents can only read their own pod info
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get"]
  resourceNames: []  # Will be restricted to self via admission controller
# Read ConfigMaps for configuration
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
# Read Secrets for API keys
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
# RoleBinding for agent permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-agent-rolebinding
  namespace: heicode-swarm-test
  labels:
    component: agent
    environment: test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-agent-role
subjects:
- kind: ServiceAccount
  name: test-agent-sa
  namespace: heicode-swarm-test

---
# NetworkPolicy to isolate test namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-isolation-policy
  namespace: heicode-swarm-test
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # Allow traffic within namespace
  - from:
    - namespaceSelector:
        matchLabels:
          environment: test
  # Allow traffic from control plane (for kubectl exec, logs)
  - from:
    - namespaceSelector:
        matchLabels:
          name: kube-system
  egress:
  # Allow DNS
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53
  # Allow traffic within namespace
  - to:
    - namespaceSelector:
        matchLabels:
          environment: test
  # Allow external API calls (model API, OpenAI-compatible, over HTTPS)
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 443
  # Allow Git operations
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 22
    - protocol: TCP
      port: 9418