From d311df6c9b3ddc7219eb1fb93d1e75f87d106be5 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 15 Aug 2026 14:27:11 -0300
Subject: [PATCH] hermes: preserve node SSH account ownership

---
 services/hermes/node-ssh-access.yaml   | 15 +++++++++++++--
 testing/tests/test_hermes_cli_lanes.py |  6 ++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/services/hermes/node-ssh-access.yaml b/services/hermes/node-ssh-access.yaml
index 6b2473de..3ab67a92 100644
--- a/services/hermes/node-ssh-access.yaml
+++ b/services/hermes/node-ssh-access.yaml
@@ -55,10 +55,14 @@ spec:
                   home="/host-home/${user}"
                   [ -d "${home}" ] || continue
                   found=1
-                  install -d -m 0700 -o "$(stat -c %u "${home}")" -g "$(stat -c %g "${home}")" "${home}/.ssh"
+                  identity="$(awk -F: -v name="${user}" '$1 == name {print $3 ":" $4; exit}' /host-etc/passwd)"
+                  [ -n "${identity}" ] || identity="$(stat -c %u:%g "${home}")"
+                  uid="${identity%%:*}"
+                  gid="${identity##*:}"
+                  install -d -m 0700 -o "${uid}" -g "${gid}" "${home}/.ssh"
                   touch "${home}/.ssh/authorized_keys"
                   grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
-                  chown "$(stat -c %u "${home}"):$(stat -c %g "${home}")" "${home}/.ssh/authorized_keys"
+                  chown "${uid}:${gid}" "${home}/.ssh/authorized_keys"
                   chmod 0600 "${home}/.ssh/authorized_keys"
                 done
                 [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
@@ -77,6 +81,9 @@ spec:
           volumeMounts:
             - name: host-home
               mountPath: /host-home
+            - name: host-passwd
+              mountPath: /host-etc/passwd
+              readOnly: true
             - name: tmp
               mountPath: /tmp
           resources:
@@ -91,6 +98,10 @@ spec:
           hostPath:
             path: /home
             type: Directory
+        - name: host-passwd
+          hostPath:
+            path: /etc/passwd
+            type: File
         - name: tmp
           emptyDir:
             sizeLimit: 8Mi
diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py
index 592030e6..d2e6decc 100644
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@@ -981,6 +981,12 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
     assert "cat /vault/secrets/node-ssh-public-key" in reconciler
     assert "grep -qxF" in reconciler
     assert "for user in atlas oceanus" in reconciler
+    assert "/host-etc/passwd" in reconciler
+    assert "chown \"${uid}:${gid}\"" in reconciler
+    host_passwd = next(
+        item for item in pod["volumes"] if item["name"] == "host-passwd"
+    )
+    assert host_passwd["hostPath"] == {"path": "/etc/passwd", "type": "File"}
 
 
 def test_owner_agent_tracks_no_ssh_identity_or_host_key_material():