From 2f9c9afcf4e7fdb3ec0895aa261060bc01d2dfab Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Wed, 5 Aug 2026 22:31:11 -0300
Subject: [PATCH] chore(hermes-triage-demo): retire repair Job service account
 and role

The fixture repair now runs in-process inside Ariadne, so the
hermes-demo-repair service account and its Role/RoleBinding have no
remaining user.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 services/hermes-triage-demo/rbac.yaml | 45 +++------------------------
 1 file changed, 4 insertions(+), 41 deletions(-)

diff --git a/services/hermes-triage-demo/rbac.yaml b/services/hermes-triage-demo/rbac.yaml
index 2adb94f6e..9e8f37286 100644
--- a/services/hermes-triage-demo/rbac.yaml
+++ b/services/hermes-triage-demo/rbac.yaml
@@ -1,18 +1,10 @@
 # services/hermes-triage-demo/rbac.yaml
-# Two scoped grants:
+# Two scoped grants, both least-privilege:
 # 1. Jenkins agent pods (SA jenkins/jenkins) create and observe the demo
 #    test-runner Job and manage the fixture ConfigMap (ensure + seed).
-# 2. The Ariadne-created repair Job runs as SA hermes-demo-repair, which can
-#    patch only the fixture ConfigMap back to healthy.
-# The Ariadne repair path needs no Job-create grant here: its
-# ariadne-job-spawner ClusterRole already covers Job create/watch.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: hermes-demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
+# 2. Ariadne's own service account patches the fixture ConfigMap back to
+#    healthy. The repair runs in-process inside Ariadne, so there is no
+#    repair Job and no separate repair service account.
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -55,35 +47,6 @@ subjects:
     name: jenkins
     namespace: jenkins
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["hermes-triage-demo-fixture"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: demo-repair
-  namespace: hermes-triage-demo
-  labels:
-    app.kubernetes.io/part-of: hermes-triage-demo
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: demo-repair
-subjects:
-  - kind: ServiceAccount
-    name: hermes-demo-repair
-    namespace: hermes-triage-demo
----
 # The fixture repair runs in-process inside Ariadne rather than as a spawned
 # Kubernetes Job, so Ariadne's own service account needs to patch exactly one
 # ConfigMap in this namespace — nothing else.