From 83f8d676402b4c47d3cd145c6e1963e5a72b05c4 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Thu, 6 Aug 2026 12:14:47 -0300
Subject: [PATCH] feat(hermes): take the Anthropic credential from Vault

The Claude subscription OAuth token was created as a manual kubectl Secret in
the interest of demo time, with migration to Vault agreed as follow-up. The
value now lives at kv/atlas/hermes/agent-tokens and is injected as a file.

The hermes role gains that path and binds the hermes-triage service account
the deployment actually runs as; it previously bound only hermes-vault. The
init container prefers the Vault file and falls back to the Secret, so this
can be rolled back by removing the annotations alone, and the Secret should be
deleted once Vault has been serving it for a while.

Vault was reachable all along without the operator credential: Ariadne already
holds a vault-admin Kubernetes auth role, which is how the value was written.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 services/hermes/deployment.yaml               | 44 ++++++++++++++++---
 .../vault/scripts/vault_k8s_auth_configure.sh |  4 +-
 2 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index d2d299542..3fe15c1a0 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -25,6 +25,22 @@ spec:
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (rpi5 preferred)
         ai.bstein.dev/config-rev: "20260804-root-operator-docs"
+        # The Anthropic credential comes from Vault rather than a manually
+        # created Secret. The role is declared in
+        # services/vault/scripts/vault_k8s_auth_configure.sh and bound to
+        # this pod's service account.
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: hermes
+        vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
+        vault.hashicorp.com/agent-inject-template-anthropic-token: |
+          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
+          {{ .Data.data.anthropic_oauth_token }}
+          {{- end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/agent-requests-cpu: 25m
+        vault.hashicorp.com/agent-requests-mem: 32Mi
+        vault.hashicorp.com/agent-limits-cpu: 100m
+        vault.hashicorp.com/agent-limits-mem: 128Mi
     spec:
       serviceAccountName: hermes-triage
       automountServiceAccountToken: true
@@ -88,6 +104,13 @@ spec:
                   name: hermes-api-server-key
                   key: api-key
                   optional: true
+            # Fallback only; Vault is preferred when its file is present.
+            - name: CLAUDE_CODE_OAUTH_TOKEN_SEED
+              valueFrom:
+                secretKeyRef:
+                  name: hermes-anthropic-token
+                  key: token
+                  optional: true
           command:
             - sh
             - -c
@@ -115,6 +138,20 @@ spec:
                 api_key="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
                 printf '\nAPI_SERVER_KEY=%s\n' "${api_key}" >> /opt/data/.env
               fi
+              # Anthropic credential: Vault first, then the manual Secret. The
+              # Secret is retained only as a rollback path while the migration
+              # settles; delete it once Vault has been serving for a while.
+              anthropic=""
+              if [ -r /vault/secrets/anthropic-token ]; then
+                anthropic="$(cat /vault/secrets/anthropic-token)"
+              elif [ -n "${CLAUDE_CODE_OAUTH_TOKEN_SEED:-}" ]; then
+                anthropic="${CLAUDE_CODE_OAUTH_TOKEN_SEED}"
+              fi
+              if [ -n "${anthropic}" ]; then
+                grep -v '^CLAUDE_CODE_OAUTH_TOKEN=' /opt/data/.env > /opt/data/.env.tmp || true
+                printf 'CLAUDE_CODE_OAUTH_TOKEN=%s\n' "${anthropic}" >> /opt/data/.env.tmp
+                mv /opt/data/.env.tmp /opt/data/.env
+              fi
               chmod 0600 /opt/data/.env
               chown -R 10000:10000 /opt/data
           securityContext:
@@ -218,12 +255,7 @@ spec:
             # falls back to openai-codex.
             # TODO: migrate to Vault alongside the Gitea token; this manual
             # Secret was created in the interest of demo time.
-            - name: CLAUDE_CODE_OAUTH_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: hermes-anthropic-token
-                  key: token
-                  optional: true
+
           volumeMounts:
             - name: home
               mountPath: /opt/data
diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index cc5903b34..191acaa6c 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -253,8 +253,8 @@ write_policy_and_role "health" "health" "health-vault-sync" \
   "health/*" ""
 write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
   "game-stream/*" ""
-write_policy_and_role "hermes" "hermes" "hermes-vault" \
-  "hermes/operator-oidc" ""
+write_policy_and_role "hermes" "hermes" "hermes-vault,hermes-triage" \
+  "hermes/operator-oidc hermes/agent-tokens" ""
 write_policy_and_role "veles" "veles" "veles-backend,veles-generator,veles-postgres,veles-vault-sync" \
   "veles/* shared/harbor-pull shared/postmark-relay" ""
 write_policy_and_role "veles-sim" "veles" "veles-sim" \