From 3431f1f58a18476046daf30395970a0c8190eeb1 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 27 Jun 2026 19:02:48 -0300
Subject: [PATCH] Deploy Veles 0.4.1 runtime support

---
 infrastructure/vault-csi/vault-csi-provider.yaml   | 5 +++++
 services/vault/scripts/vault_k8s_auth_configure.sh | 2 ++
 services/veles/backend-deployment.yaml             | 4 ++--
 services/veles/configmap.yaml                      | 4 ++--
 services/veles/frontend-deployment.yaml            | 2 +-
 services/veles/retention-cronjob.yaml              | 2 +-
 services/veles/secretproviderclass.yaml            | 2 +-
 7 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/infrastructure/vault-csi/vault-csi-provider.yaml b/infrastructure/vault-csi/vault-csi-provider.yaml
index ab177bd07..94b21ebeb 100644
--- a/infrastructure/vault-csi/vault-csi-provider.yaml
+++ b/infrastructure/vault-csi/vault-csi-provider.yaml
@@ -71,6 +71,11 @@ spec:
       labels: { app.kubernetes.io/name: vault-csi-provider }
     spec:
       serviceAccountName: vault-csi-provider
+      tolerations:
+        - key: veles.bstein.dev/simulation
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
       containers:
         - name: provider-vault-installer
           image: hashicorp/vault-csi-provider:1.7.0
diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index 43d4b55e7..f9ab8045d 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -242,6 +242,8 @@ write_policy_and_role "openclaw" "openclaw" "agent-vault" \
   "openclaw/*" ""
 write_policy_and_role "veles" "veles" "veles-backend,veles-postgres,veles-vault-sync" \
   "veles/* shared/harbor-pull shared/postmark-relay" ""
+write_policy_and_role "veles-sim" "veles" "veles-sim" \
+  "veles/codex-cli" ""
 write_policy_and_role "veles-secrets" "veles" "veles-secrets-ensure" \
   "shared/postmark-relay" \
   "veles/*"
diff --git a/services/veles/backend-deployment.yaml b/services/veles/backend-deployment.yaml
index cac74a6b9..18cbf5dc6 100644
--- a/services/veles/backend-deployment.yaml
+++ b/services/veles/backend-deployment.yaml
@@ -57,7 +57,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: database-init
-          image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:
@@ -79,7 +79,7 @@ spec:
               memory: 512Mi
       containers:
         - name: backend
-          image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:
diff --git a/services/veles/configmap.yaml b/services/veles/configmap.yaml
index 505ee53e2..791c67716 100644
--- a/services/veles/configmap.yaml
+++ b/services/veles/configmap.yaml
@@ -18,7 +18,7 @@ data:
   VELES_OIDC_REQUIRED_GROUPS: alpha,veles-tester,admin
   VELES_OIDC_ADMIN_GROUPS: admin
   VELES_NAMESPACE: veles
-  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.3.16 # {"$imagepolicy": "veles:veles-sim-worker"}
+  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.4.1 # {"$imagepolicy": "veles:veles-sim-worker"}
   VELES_SIM_SERVICE_ACCOUNT: veles-sim
   VELES_SIM_PRIORITY_CLASS: veles-sim
   VELES_SIM_NODE_SELECTOR: veles.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
@@ -41,5 +41,5 @@ data:
   VELES_SIM_ENGINE_PVC: veles-engine-cache
   VELES_SIM_ENGINE_MOUNT_PATH: /engine
   VELES_SIM_CODEX_CLI_SECRET_PROVIDER_CLASS: veles-codex-cli
-  VELES_SIM_CODEX_CLI_MOUNT_PATH: /home/veles/.codex
+  VELES_SIM_CODEX_CLI_MOUNT_PATH: /var/run/veles-codex-cli
   VELES_SIM_CODEX_CLI_HOME: /home/veles/.codex
diff --git a/services/veles/frontend-deployment.yaml b/services/veles/frontend-deployment.yaml
index e1e014990..95ef9e91f 100644
--- a/services/veles/frontend-deployment.yaml
+++ b/services/veles/frontend-deployment.yaml
@@ -48,7 +48,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: frontend
-          image: registry.bstein.dev/veles/veles-frontend:0.3.16 # {"$imagepolicy": "veles:veles-frontend"}
+          image: registry.bstein.dev/veles/veles-frontend:0.4.1 # {"$imagepolicy": "veles:veles-frontend"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/services/veles/retention-cronjob.yaml b/services/veles/retention-cronjob.yaml
index 156c19d56..b4c9f566a 100644
--- a/services/veles/retention-cronjob.yaml
+++ b/services/veles/retention-cronjob.yaml
@@ -37,7 +37,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: retention
-              image: registry.bstein.dev/veles/veles-backend:0.3.16 # {"$imagepolicy": "veles:veles-backend"}
+              image: registry.bstein.dev/veles/veles-backend:0.4.1 # {"$imagepolicy": "veles:veles-backend"}
               imagePullPolicy: IfNotPresent
               command: ["veles-hygiene"]
               args: ["--prune-artifacts"]
diff --git a/services/veles/secretproviderclass.yaml b/services/veles/secretproviderclass.yaml
index d39279a5b..4652ebca5 100644
--- a/services/veles/secretproviderclass.yaml
+++ b/services/veles/secretproviderclass.yaml
@@ -67,4 +67,4 @@ spec:
       - objectName: "auth.json"
         secretPath: "kv/data/atlas/veles/codex-cli"
         secretKey: "auth.json"
-        filePermission: "0440"
+        filePermission: 292