titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

fix(hermes-voice): unpack Jetson image capabilities

Browse Source
This commit is contained in:
jenkins 2026-08-23 16:05:09 -03:00
parent ef32843a76
commit 5c986eabaa
3 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ci/Jenkinsfile.hermes-voice-image
View File

@ -71,7 +71,10 @@ spec:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
drop: ["ALL"] drop: ["ALL"]
add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"] # The pinned Jetson Whisper base contains gst-ptp-helper with a
# security.capability xattr. Kaniko needs SETFCAP only while
# unpacking that reviewed base; the pod remains non-privileged.
add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID", "SETFCAP"]
runAsUser: 0 runAsUser: 0
seccompProfile: {type: RuntimeDefault} seccompProfile: {type: RuntimeDefault}
resources: resources:

1
services/jenkins/configmap-jcasc.yaml
View File

@ -702,6 +702,7 @@ data:
} }
pipelineJob('hermes-voice-image') { pipelineJob('hermes-voice-image') {
disabled(false) disabled(false)
concurrentBuild(false)
description('Bounded daemonless Kaniko release for reviewed Hermes STT or TTS source. A validated immutable release tag is consumed by Flux.') description('Bounded daemonless Kaniko release for reviewed Hermes STT or TTS source. A validated immutable release tag is consumed by Flux.')
authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN')) authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))
parameters { parameters {

3
testing/tests/test_hermes_voice_release.py
View File

@ -20,6 +20,8 @@ def test_voice_pipeline_binds_component_source_digest_and_release() -> None:
assert "PUBLISH HERMES STT" in pipeline assert "PUBLISH HERMES STT" in pipeline
assert "PUBLISH HERMES TTS" in pipeline assert "PUBLISH HERMES TTS" in pipeline
assert "archiveArtifacts(" in pipeline assert "archiveArtifacts(" in pipeline
assert '"SETFCAP"' in pipeline
assert "privileged: true" not in pipeline
def test_jenkins_declares_one_token_guarded_voice_job() -> None: def test_jenkins_declares_one_token_guarded_voice_job() -> None:
@ -29,6 +31,7 @@ def test_jenkins_declares_one_token_guarded_voice_job() -> None:
"multibranchPipelineJob('titan-iac-quality-gate')", 1 "multibranchPipelineJob('titan-iac-quality-gate')", 1
)[0] )[0]
assert "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block assert "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block
assert "concurrentBuild(false)" in block
assert "scriptPath('ci/Jenkinsfile.hermes-voice-image')" in block assert "scriptPath('ci/Jenkinsfile.hermes-voice-image')" in block