flux(hermes): track owner oauth sidecar health

clusters/atlas/flux-system/applications/hermes/kustomization.yaml

@@ -42,10 +42,6 @@ spec:
       kind: Deployment
       name: hermes-chat-router
       namespace: hermes
-    - apiVersion: apps/v1
-      kind: Deployment
-      name: oauth2-proxy-hermes-agent
-      namespace: hermes
     - apiVersion: apps/v1
       kind: Deployment
       name: oauth2-proxy-hermes-chat

testing/tests/test_hermes_cli_lanes.py

@@ -17,6 +17,10 @@ import yaml
 SCRIPTS = Path(__file__).parents[2] / "services/hermes/scripts"
 HERMES = Path(__file__).parents[2] / "services/hermes"
 KEYCLOAK = Path(__file__).parents[2] / "services/keycloak"
+FLUX_HERMES = (
+    Path(__file__).parents[2]
+    / "clusters/atlas/flux-system/applications/hermes/kustomization.yaml"
+)
 
 
 def _load(name: str):
@@ -704,6 +708,16 @@ def test_agent_root_is_stock_dashboard_and_terminal_is_a_separate_path():
     ] == "hermes-hermes-agent-terminal-slash@kubernetescrd"
 
 
+def test_flux_health_checks_follow_the_owner_oauth_sidecar():
+    flux = yaml.safe_load(FLUX_HERMES.read_text())
+    checks = {
+        (item["kind"], item["name"])
+        for item in flux["spec"]["healthChecks"]
+    }
+    assert ("Deployment", "hermes-agent") in checks
+    assert ("Deployment", "oauth2-proxy-hermes-agent") not in checks
+
+
 def test_agent_auth_is_bstein_group_and_email_bounded():
     deployment = _agent_deployment()
     oauth = next(