# services/hermes/node-ssh-access.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
data:
  authorized_key: >-
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
spec:
  selector:
    matchLabels:
      app: hermes-node-ssh-access
  template:
    metadata:
      labels:
        app: hermes-node-ssh-access
    spec:
      automountServiceAccountToken: false
      tolerations:
        - operator: Exists
      containers:
        - name: key-reconciler
          image: busybox:1.37
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - |
              reconcile() {
                key="$(cat /config/authorized_key)"
                found=0
                for user in atlas oceanus; do
                  home="/host-home/${user}"
                  [ -d "${home}" ] || continue
                  found=1
                  install -d -m 0700 -o "$(stat -c %u "${home}")" -g "$(stat -c %g "${home}")" "${home}/.ssh"
                  touch "${home}/.ssh/authorized_keys"
                  grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
                  chown "$(stat -c %u "${home}"):$(stat -c %g "${home}")" "${home}/.ssh/authorized_keys"
                  chmod 0600 "${home}/.ssh/authorized_keys"
                done
                [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
              }
              while true; do
                reconcile
                sleep 300
              done
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 0
            runAsGroup: 0
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: access-config
              mountPath: /config
              readOnly: true
            - name: host-home
              mountPath: /host-home
            - name: tmp
              mountPath: /tmp
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 32Mi
      volumes:
        - name: access-config
          configMap:
            name: hermes-node-ssh-access
        - name: host-home
          hostPath:
            path: /home
            type: Directory
        - name: tmp
          emptyDir:
            sizeLimit: 8Mi