Deploy Veles 0.4.1 runtime support

infrastructure/vault-csi/vault-csi-provider.yaml

@@ -71,6 +71,11 @@ spec:
       labels: { app.kubernetes.io/name: vault-csi-provider }
     spec:
       serviceAccountName: vault-csi-provider
+      tolerations:
+        - key: veles.bstein.dev/simulation
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
       containers:
         - name: provider-vault-installer
           image: hashicorp/vault-csi-provider:1.7.0

services/vault/scripts/vault_k8s_auth_configure.sh

@@ -242,6 +242,8 @@ write_policy_and_role "openclaw" "openclaw" "agent-vault" \
   "openclaw/*" ""
 write_policy_and_role "veles" "veles" "veles-backend,veles-postgres,veles-vault-sync" \
   "veles/* shared/harbor-pull shared/postmark-relay" ""
+write_policy_and_role "veles-sim" "veles" "veles-sim" \
+  "veles/codex-cli" ""
 write_policy_and_role "veles-secrets" "veles" "veles-secrets-ensure" \
   "shared/postmark-relay" \
   "veles/*"

services/veles/backend-deployment.yaml

@@ -57,7 +57,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: database-init
-          image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:
@@ -79,7 +79,7 @@ spec:
               memory: 512Mi
       containers:
         - name: backend
-          image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:

services/veles/configmap.yaml

@@ -18,7 +18,7 @@ data:
   VELES_OIDC_REQUIRED_GROUPS: alpha,veles-tester,admin
   VELES_OIDC_ADMIN_GROUPS: admin
   VELES_NAMESPACE: veles
-  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.3.16 # {"$imagepolicy": "veles:veles-sim-worker"}
+  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.4.1 # {"$imagepolicy": "veles:veles-sim-worker"}
   VELES_SIM_SERVICE_ACCOUNT: veles-sim
   VELES_SIM_PRIORITY_CLASS: veles-sim
   VELES_SIM_NODE_SELECTOR: veles.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
@@ -41,5 +41,5 @@ data:
   VELES_SIM_ENGINE_PVC: veles-engine-cache
   VELES_SIM_ENGINE_MOUNT_PATH: /engine
   VELES_SIM_CODEX_CLI_SECRET_PROVIDER_CLASS: veles-codex-cli
-  VELES_SIM_CODEX_CLI_MOUNT_PATH: /home/veles/.codex
+  VELES_SIM_CODEX_CLI_MOUNT_PATH: /var/run/veles-codex-cli
   VELES_SIM_CODEX_CLI_HOME: /home/veles/.codex

services/veles/frontend-deployment.yaml

@@ -48,7 +48,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: frontend
-          image: registry.bstein.dev/veles/veles-frontend:0.3.16 # {"$imagepolicy": "veles:veles-frontend"}
+          image: registry.bstein.dev/veles/veles-frontend:0.4.1 # {"$imagepolicy": "veles:veles-frontend"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

services/veles/retention-cronjob.yaml

@@ -37,7 +37,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: retention
-              image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+              image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
               imagePullPolicy: IfNotPresent
               command: ["veles-hygiene"]
               args: ["--prune-artifacts"]

services/veles/secretproviderclass.yaml

@@ -67,4 +67,4 @@ spec:
       - objectName: "auth.json"
         secretPath: "kv/data/atlas/veles/codex-cli"
         secretKey: "auth.json"
-        filePermission: "0440"
+        filePermission: 292