School-district demo day apps need temporary Run:ai inference access. What deployment control fits?
Select an answer to reveal the explanation.
Short Explanation
You can keep demo access focused and safer with short-lived tokens that expire when the civic demo ends. A shared, non-expiring cluster-admin credential, disabled authentication, or a forever password on the projector would leave access far too broad or long-lived.
Full Explanation
Issue short-lived tokens for time-bounded Run:ai inference during the school-district demo. Ephemeral credentials let students and apps access inference only during the civic demo window, then expire, limiting the blast radius if a laptop is lost or a slide is photographed. Pair the tokens with least-privilege project roles that can invoke inference but cannot administer the cluster. Packaging each student app with a shared, non-expiring cluster-admin credential gives anyone who extracts it control of the municipal cluster. Disabling authentication turns the inference endpoint into an open relay. Sharing one forever password on the auditorium projector exposes a long-lived secret to everyone present and anyone who records the talk. Exam caveat: short-lived tokens require a working IdP/OIDC or Run:ai token flow and clock sync; misconfigured issuance can make the demo fail closed, so rehearse it. Prefer audience-scoped tokens for the inference API, not Kubernetes API tokens with broad RBAC, and rotate or revoke tokens after demo day. Practical check: mint tokens with a TTL matching the event, verify access, then wait for expiry or revoke them and confirm subsequent calls fail; scan demo repos and slides for committed long-lived secrets.