diff --git a/services/hermes/switchyard-deployment.yaml b/services/hermes/switchyard-deployment.yaml index 2470a7684..f66b1a5b4 100644 --- a/services/hermes/switchyard-deployment.yaml +++ b/services/hermes/switchyard-deployment.yaml @@ -19,7 +19,7 @@ spec: labels: app: hermes-switchyard annotations: - ai.bstein.dev/config-rev: "20260811-switchyard-authority-v3" + ai.bstein.dev/config-rev: "20260811-switchyard-authority-v4" prometheus.io/scrape: "true" prometheus.io/port: "9005" prometheus.io/path: /metrics @@ -63,7 +63,7 @@ spec: values: ["true"] - key: kubernetes.io/hostname operator: NotIn - values: [titan-18, titan-22, titan-24] + values: [titan-14, titan-18, titan-22, titan-24] containers: - name: switchyard image: registry.bstein.dev/bstein/hermes-switchyard@sha256:3d952d528a4e4cb8afdf84f8995272f5d6107dc127b68cc20234b1da4aff43eb @@ -241,7 +241,7 @@ spec: defaultMode: 0555 - name: state persistentVolumeClaim: - claimName: hermes-switchyard-state + claimName: hermes-switchyard-state-rwx - name: routing-catalog persistentVolumeClaim: claimName: hermes-routing-catalog diff --git a/services/hermes/switchyard-pvc.yaml b/services/hermes/switchyard-pvc.yaml index 5580c1e66..1a3c50050 100644 --- a/services/hermes/switchyard-pvc.yaml +++ b/services/hermes/switchyard-pvc.yaml @@ -13,3 +13,18 @@ spec: resources: requests: storage: 2Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: hermes-switchyard-state-rwx + namespace: hermes + labels: + app: hermes-switchyard +spec: + accessModes: + - ReadWriteMany + storageClassName: astreae + resources: + requests: + storage: 2Gi diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py index 78bfe33ec..99ea2b2b4 100644 --- a/testing/tests/test_hermes_cli_lanes.py +++ b/testing/tests/test_hermes_cli_lanes.py @@ -872,6 +872,28 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog(): ] +def test_switchyard_active_state_uses_a_relocatable_rwx_claim(): + """A stale node attachment must not strand the routing authority.""" + claims = [ + item + for item in yaml.safe_load_all((HERMES / "switchyard-pvc.yaml").read_text()) + if item + ] + active_claim = next( + item + for item in claims + if item["metadata"]["name"] == "hermes-switchyard-state-rwx" + ) + assert active_claim["spec"]["accessModes"] == ["ReadWriteMany"] + + deployment = yaml.safe_load((HERMES / "switchyard-deployment.yaml").read_text()) + pod = deployment["spec"]["template"]["spec"] + state = next(item for item in pod["volumes"] if item["name"] == "state") + assert state["persistentVolumeClaim"]["claimName"] == active_claim["metadata"][ + "name" + ] + + def test_switchyard_network_boundary_allows_vault_bootstrap(): """The pre-populate init container must reach Vault before routing starts.""" documents = [