From 9bf41dc0deb95a45c8fd82c8e86417e55587a1d1 Mon Sep 17 00:00:00 2001 From: jenkins Date: Sat, 22 Aug 2026 16:39:44 -0300 Subject: [PATCH] hermes: decouple node maintenance health --- .../flux-system/applications/hermes/kustomization.yaml | 7 +++---- testing/tests/test_hermes_cli_lanes_access.py | 4 ++-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml index 611794d5..6ec8b3d1 100644 --- a/clusters/atlas/flux-system/applications/hermes/kustomization.yaml +++ b/clusters/atlas/flux-system/applications/hermes/kustomization.yaml @@ -36,10 +36,9 @@ spec: # would stall hermes-chat and hermes-observer-bindings, which dependsOn # hermes. The pool reports its own health through the worker readiness probe, # the per-ordinal mediator /ready endpoint, and the coordinator on :9007. - - apiVersion: apps/v1 - kind: DaemonSet - name: hermes-node-ssh-access - namespace: hermes + # The node SSH hardener is deliberately absent. It reconciles every node, + # including offline and maintenance hosts, so its availability must not + # turn a node-local account issue into a blocked owner-service rollout. - apiVersion: apps/v1 kind: Deployment name: hermes diff --git a/testing/tests/test_hermes_cli_lanes_access.py b/testing/tests/test_hermes_cli_lanes_access.py index 9e5a8352..8abbbd89 100644 --- a/testing/tests/test_hermes_cli_lanes_access.py +++ b/testing/tests/test_hermes_cli_lanes_access.py @@ -90,11 +90,11 @@ def test_agent_refreshes_routes_after_restoring_cli_logins(): ) in hermes_mounts -def test_flux_health_checks_follow_the_owner_oauth_sidecar(): +def test_flux_health_checks_gate_the_owner_without_node_maintenance(): flux = yaml.safe_load(FLUX_HERMES.read_text()) checks = {(item["kind"], item["name"]) for item in flux["spec"]["healthChecks"]} assert ("Deployment", "hermes-agent") in checks - assert ("DaemonSet", "hermes-node-ssh-access") in checks + assert ("DaemonSet", "hermes-node-ssh-access") not in checks assert ("Deployment", "oauth2-proxy-hermes-agent") not in checks