Keep a coding agent inside a locked-down cluster.
The pod exposes no cluster-facing endpoint and reaches one relay on TCP 443. Your terminal reaches the same relay, attaches through an end-to-end encrypted link, and keeps the real model credential outside the cluster.
Then point kubectl at your cluster and run pond node install.
One node command
pond node install provisions the link and applies one Secret, PVC, Deployment, and default-deny NetworkPolicy.
Only outbound 443
The pod and your terminal each dial one relay over WSS. Neither exposes a cluster-facing or public endpoint.
One narrow link
Source, terminal, and model RPC are explicit protocol streams. Pond Link is not a TCP, CONNECT, or SOCKS proxy.
Persistent workspace
The repository lives on a PVC. The agent and PTY keep running when your terminal disconnects while the pod stays alive.
Provider key stays local
Model calls traverse the encrypted link and leave from your receiver. The pod sees a loopback broker and a dummy key.
Blind relay
Mutually pinned Noise KK encryption protects payloads independently of relay TLS. Self-host the tiny stateless relay if needed.