# services/hermes/node-ssh-access.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: hermes-node-ssh
    objects: |
      - objectName: "node-ssh-public-key"
        secretPath: "kv/data/atlas/hermes/developer-ssh"
        secretKey: "public_key"
        filePermission: 256
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
spec:
  selector:
    matchLabels:
      app: hermes-node-ssh-access
  template:
    metadata:
      labels:
        app: hermes-node-ssh-access
    spec:
      serviceAccountName: hermes-node-ssh-access
      automountServiceAccountToken: true
      tolerations:
        - operator: Exists
      containers:
        - name: key-reconciler
          image: busybox:1.37
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - |
              reconcile() {
                key="$(cat /vault/secrets/node-ssh-public-key)"
                found=0
                for user in atlas oceanus; do
                  home="/host-home/${user}"
                  [ -d "${home}" ] || continue
                  found=1
                  identity="$(awk -F: -v name="${user}" '$1 == name {print $3 ":" $4; exit}' /host-etc/passwd)"
                  [ -n "${identity}" ] || identity="$(stat -c %u:%g "${home}")"
                  uid="${identity%%:*}"
                  gid="${identity##*:}"
                  install -d -m 0700 -o "${uid}" -g "${gid}" "${home}/.ssh"
                  touch "${home}/.ssh/authorized_keys"
                  grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
                  chown "${uid}:${gid}" "${home}/.ssh/authorized_keys"
                  chmod 0600 "${home}/.ssh/authorized_keys"
                done
                [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
              }
              while true; do
                reconcile
                sleep 300
              done
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 0
            runAsGroup: 0
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: host-home
              mountPath: /host-home
            - name: host-passwd
              mountPath: /host-etc/passwd
              readOnly: true
            - name: vault-secrets
              mountPath: /vault/secrets
              readOnly: true
            - name: tmp
              mountPath: /tmp
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 32Mi
      volumes:
        - name: host-home
          hostPath:
            path: /home
            type: Directory
        - name: host-passwd
          hostPath:
            path: /etc/passwd
            type: File
        - name: vault-secrets
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: hermes-node-ssh-access
        - name: tmp
          emptyDir:
            sizeLimit: 8Mi