83f8d67640
Some checks failed
Tests / Declarative: Post Actions testing.tests.test_repo_structure.test_knowledge_service_mirror_matches_source failed
The Claude subscription OAuth token was created as a manual kubectl Secret in the interest of demo time, with migration to Vault agreed as follow-up. The value now lives at kv/atlas/hermes/agent-tokens and is injected as a file. The hermes role gains that path and binds the hermes-triage service account the deployment actually runs as; it previously bound only hermes-vault. The init container prefers the Vault file and falls back to the Secret, so this can be rolled back by removing the annotations alone, and the Secret should be deleted once Vault has been serving it for a while. Vault was reachable all along without the operator credential: Ariadne already holds a vault-admin Kubernetes auth role, which is how the value was written. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
titan-iac
Flux-managed Kubernetes desired-state config for bstein.dev.
Canonical source URL:
ssh://git@scm.bstein.dev:2242/bstein/titan-iac.git
Scope
This repo contains cluster configuration consumed by Flux:
- platform/infrastructure manifests
- service manifests and kustomizations
- operational scripts for render/reconcile workflows
Apply model
I use Git + Flux as the source of truth and avoid manual in-cluster edits for durable changes.