# Privileged HMAC and SCM mediation runs outside the model Pods. Each mediator is # colocated with exactly one ordinal's RWO workspace but has a distinct network # identity, private HMAC derivation, and durable integrity state. apiVersion: v1 kind: PersistentVolumeClaim metadata: {name: hermes-execution-mediator-state-0, namespace: hermes} spec: accessModes: [ReadWriteOnce] storageClassName: astreae resources: {requests: {storage: 1Gi}} --- apiVersion: v1 kind: PersistentVolumeClaim metadata: {name: hermes-execution-mediator-state-1, namespace: hermes} spec: accessModes: [ReadWriteOnce] storageClassName: astreae resources: {requests: {storage: 1Gi}} --- apiVersion: v1 kind: PersistentVolumeClaim metadata: {name: hermes-execution-mediator-state-2, namespace: hermes} spec: accessModes: [ReadWriteOnce] storageClassName: astreae resources: {requests: {storage: 1Gi}} --- apiVersion: v1 kind: Service metadata: {name: hermes-execution-mediator-0, namespace: hermes} spec: selector: {app: hermes-execution-mediator, pool-ordinal: "0"} ports: [{name: mediator, port: 9009, targetPort: mediator}] --- apiVersion: v1 kind: Service metadata: {name: hermes-execution-mediator-1, namespace: hermes} spec: selector: {app: hermes-execution-mediator, pool-ordinal: "1"} ports: [{name: mediator, port: 9009, targetPort: mediator}] --- apiVersion: v1 kind: Service metadata: {name: hermes-execution-mediator-2, namespace: hermes} spec: selector: {app: hermes-execution-mediator, pool-ordinal: "2"} ports: [{name: mediator, port: 9009, targetPort: mediator}] --- apiVersion: apps/v1 kind: Deployment metadata: name: hermes-execution-mediator-0 namespace: hermes labels: {app: hermes-execution-mediator, pool-ordinal: "0"} spec: replicas: 1 strategy: {type: Recreate} selector: matchLabels: {app: hermes-execution-mediator, pool-ordinal: "0"} template: metadata: labels: {app: hermes-execution-mediator, pool-ordinal: "0"} annotations: ai.bstein.dev/config-rev: execution-pool-v2-mediated ai.bstein.dev/security-boundary: model-pod-has-no-hmac-or-scm-network-authority vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/role: hermes-execution-worker vault.hashicorp.com/agent-inject-containers: stage-mediator-access vault.hashicorp.com/agent-service-account-token-volume-name: vault-auth-token vault.hashicorp.com/agent-inject-secret-execution-pool-key: kv/data/atlas/hermes/agent-tokens vault.hashicorp.com/agent-inject-perms-execution-pool-key: "0600" vault.hashicorp.com/agent-inject-template-execution-pool-key: | {{- with secret "kv/data/atlas/hermes/agent-tokens" -}} {{ printf "hermes-execution-pool-root-v2:%s" .Data.data.agent_api_key | sha256sum }} {{- end }} vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-requests-cpu: 2m vault.hashicorp.com/agent-requests-mem: 16Mi vault.hashicorp.com/agent-limits-cpu: 100m vault.hashicorp.com/agent-limits-mem: 128Mi spec: serviceAccountName: hermes-execution-worker automountServiceAccountToken: false enableServiceLinks: false securityContext: fsGroup: 10000 fsGroupChangePolicy: OnRootMismatch seccompProfile: {type: RuntimeDefault} affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: statefulset.kubernetes.io/pod-name: hermes-execution-worker-0 topologyKey: kubernetes.io/hostname initContainers: - name: stage-mediator-access image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/stage_runtime_access.py, execution-mediator] env: - {name: HERMES_WORKER_ORDINAL, value: "0"} - {name: HERMES_POOL_ACCESS_ROOT, value: /pool-access} securityContext: allowPrivilegeEscalation: false runAsUser: 0 runAsGroup: 0 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: pool-access, mountPath: /pool-access} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} resources: requests: {cpu: 2m, memory: 16Mi} limits: {cpu: 100m, memory: 64Mi} containers: - name: execution-mediator image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/execution_pool_client.py] env: - {name: HERMES_WORKER_ORDINAL, value: "0"} - {name: HERMES_WORKER_ROOT, value: /workspace} - {name: HERMES_SCM_STATE_ROOT, value: /scm-state} - {name: HERMES_EXECUTION_POOL_KEY_FILE, value: /pool-access/execution-pool-key} - {name: PYTHONPATH, value: /opt/scm:/opt/coordinator:/opt/hermes} ports: [{name: mediator, containerPort: 9009, protocol: TCP}] startupProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 5 failureThreshold: 60 readinessProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 10 securityContext: allowPrivilegeEscalation: false capabilities: {drop: [ALL]} readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 10000 runAsGroup: 10000 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: workspace, mountPath: /workspace} - {name: scm-state, mountPath: /scm-state} - {name: pool-access, mountPath: /pool-access, readOnly: true} - {name: scm-broker-client, mountPath: /opt/scm, readOnly: true} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} - {name: tmp, mountPath: /tmp} resources: requests: {cpu: 2m, memory: 64Mi} limits: {cpu: 250m, memory: 256Mi} volumes: - name: workspace persistentVolumeClaim: {claimName: workspace-hermes-execution-worker-0} - name: scm-state persistentVolumeClaim: {claimName: hermes-execution-mediator-state-0} - name: pool-access emptyDir: {medium: Memory, sizeLimit: 1Mi} - name: scm-broker-client configMap: {name: hermes-scm-boundary-v2, defaultMode: 0555} - name: coordinator configMap: {name: hermes-execution-pool, defaultMode: 0555} - name: tmp emptyDir: {sizeLimit: 64Mi} - name: vault-auth-token projected: defaultMode: 0600 sources: - serviceAccountToken: {audience: vault, expirationSeconds: 3600, path: token} - configMap: name: kube-root-ca.crt items: [{key: ca.crt, path: ca.crt}] - downwardAPI: items: [{path: namespace, fieldRef: {fieldPath: metadata.namespace}}] --- apiVersion: apps/v1 kind: Deployment metadata: name: hermes-execution-mediator-1 namespace: hermes labels: {app: hermes-execution-mediator, pool-ordinal: "1"} spec: replicas: 1 strategy: {type: Recreate} selector: matchLabels: {app: hermes-execution-mediator, pool-ordinal: "1"} template: metadata: labels: {app: hermes-execution-mediator, pool-ordinal: "1"} annotations: ai.bstein.dev/config-rev: execution-pool-v2-mediated ai.bstein.dev/security-boundary: model-pod-has-no-hmac-or-scm-network-authority vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/role: hermes-execution-worker vault.hashicorp.com/agent-inject-containers: stage-mediator-access vault.hashicorp.com/agent-service-account-token-volume-name: vault-auth-token vault.hashicorp.com/agent-inject-secret-execution-pool-key: kv/data/atlas/hermes/agent-tokens vault.hashicorp.com/agent-inject-perms-execution-pool-key: "0600" vault.hashicorp.com/agent-inject-template-execution-pool-key: | {{- with secret "kv/data/atlas/hermes/agent-tokens" -}} {{ printf "hermes-execution-pool-root-v2:%s" .Data.data.agent_api_key | sha256sum }} {{- end }} vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-requests-cpu: 2m vault.hashicorp.com/agent-requests-mem: 16Mi vault.hashicorp.com/agent-limits-cpu: 100m vault.hashicorp.com/agent-limits-mem: 128Mi spec: serviceAccountName: hermes-execution-worker automountServiceAccountToken: false enableServiceLinks: false securityContext: fsGroup: 10000 fsGroupChangePolicy: OnRootMismatch seccompProfile: {type: RuntimeDefault} affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: statefulset.kubernetes.io/pod-name: hermes-execution-worker-1 topologyKey: kubernetes.io/hostname initContainers: - name: stage-mediator-access image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/stage_runtime_access.py, execution-mediator] env: - {name: HERMES_WORKER_ORDINAL, value: "1"} - {name: HERMES_POOL_ACCESS_ROOT, value: /pool-access} securityContext: allowPrivilegeEscalation: false runAsUser: 0 runAsGroup: 0 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: pool-access, mountPath: /pool-access} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} resources: requests: {cpu: 2m, memory: 16Mi} limits: {cpu: 100m, memory: 64Mi} containers: - name: execution-mediator image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/execution_pool_client.py] env: - {name: HERMES_WORKER_ORDINAL, value: "1"} - {name: HERMES_WORKER_ROOT, value: /workspace} - {name: HERMES_SCM_STATE_ROOT, value: /scm-state} - {name: HERMES_EXECUTION_POOL_KEY_FILE, value: /pool-access/execution-pool-key} - {name: PYTHONPATH, value: /opt/scm:/opt/coordinator:/opt/hermes} ports: [{name: mediator, containerPort: 9009, protocol: TCP}] startupProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 5 failureThreshold: 60 readinessProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 10 securityContext: allowPrivilegeEscalation: false capabilities: {drop: [ALL]} readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 10000 runAsGroup: 10000 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: workspace, mountPath: /workspace} - {name: scm-state, mountPath: /scm-state} - {name: pool-access, mountPath: /pool-access, readOnly: true} - {name: scm-broker-client, mountPath: /opt/scm, readOnly: true} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} - {name: tmp, mountPath: /tmp} resources: requests: {cpu: 2m, memory: 64Mi} limits: {cpu: 250m, memory: 256Mi} volumes: - name: workspace persistentVolumeClaim: {claimName: workspace-hermes-execution-worker-1} - name: scm-state persistentVolumeClaim: {claimName: hermes-execution-mediator-state-1} - name: pool-access emptyDir: {medium: Memory, sizeLimit: 1Mi} - name: scm-broker-client configMap: {name: hermes-scm-boundary-v2, defaultMode: 0555} - name: coordinator configMap: {name: hermes-execution-pool, defaultMode: 0555} - name: tmp emptyDir: {sizeLimit: 64Mi} - name: vault-auth-token projected: defaultMode: 0600 sources: - serviceAccountToken: {audience: vault, expirationSeconds: 3600, path: token} - configMap: name: kube-root-ca.crt items: [{key: ca.crt, path: ca.crt}] - downwardAPI: items: [{path: namespace, fieldRef: {fieldPath: metadata.namespace}}] --- apiVersion: apps/v1 kind: Deployment metadata: name: hermes-execution-mediator-2 namespace: hermes labels: {app: hermes-execution-mediator, pool-ordinal: "2"} spec: replicas: 1 strategy: {type: Recreate} selector: matchLabels: {app: hermes-execution-mediator, pool-ordinal: "2"} template: metadata: labels: {app: hermes-execution-mediator, pool-ordinal: "2"} annotations: ai.bstein.dev/config-rev: execution-pool-v2-mediated ai.bstein.dev/security-boundary: model-pod-has-no-hmac-or-scm-network-authority vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/role: hermes-execution-worker vault.hashicorp.com/agent-inject-containers: stage-mediator-access vault.hashicorp.com/agent-service-account-token-volume-name: vault-auth-token vault.hashicorp.com/agent-inject-secret-execution-pool-key: kv/data/atlas/hermes/agent-tokens vault.hashicorp.com/agent-inject-perms-execution-pool-key: "0600" vault.hashicorp.com/agent-inject-template-execution-pool-key: | {{- with secret "kv/data/atlas/hermes/agent-tokens" -}} {{ printf "hermes-execution-pool-root-v2:%s" .Data.data.agent_api_key | sha256sum }} {{- end }} vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-requests-cpu: 2m vault.hashicorp.com/agent-requests-mem: 16Mi vault.hashicorp.com/agent-limits-cpu: 100m vault.hashicorp.com/agent-limits-mem: 128Mi spec: serviceAccountName: hermes-execution-worker automountServiceAccountToken: false enableServiceLinks: false securityContext: fsGroup: 10000 fsGroupChangePolicy: OnRootMismatch seccompProfile: {type: RuntimeDefault} affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: statefulset.kubernetes.io/pod-name: hermes-execution-worker-2 topologyKey: kubernetes.io/hostname initContainers: - name: stage-mediator-access image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/stage_runtime_access.py, execution-mediator] env: - {name: HERMES_WORKER_ORDINAL, value: "2"} - {name: HERMES_POOL_ACCESS_ROOT, value: /pool-access} securityContext: allowPrivilegeEscalation: false runAsUser: 0 runAsGroup: 0 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: pool-access, mountPath: /pool-access} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} resources: requests: {cpu: 2m, memory: 16Mi} limits: {cpu: 100m, memory: 64Mi} containers: - name: execution-mediator image: registry.bstein.dev/bstein/hermes-agent command: [/opt/hermes/.venv/bin/python, /opt/coordinator/execution_pool_client.py] env: - {name: HERMES_WORKER_ORDINAL, value: "2"} - {name: HERMES_WORKER_ROOT, value: /workspace} - {name: HERMES_SCM_STATE_ROOT, value: /scm-state} - {name: HERMES_EXECUTION_POOL_KEY_FILE, value: /pool-access/execution-pool-key} - {name: PYTHONPATH, value: /opt/scm:/opt/coordinator:/opt/hermes} ports: [{name: mediator, containerPort: 9009, protocol: TCP}] startupProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 5 failureThreshold: 60 readinessProbe: httpGet: {path: /ready, port: mediator} periodSeconds: 10 securityContext: allowPrivilegeEscalation: false capabilities: {drop: [ALL]} readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 10000 runAsGroup: 10000 seccompProfile: {type: RuntimeDefault} volumeMounts: - {name: workspace, mountPath: /workspace} - {name: scm-state, mountPath: /scm-state} - {name: pool-access, mountPath: /pool-access, readOnly: true} - {name: scm-broker-client, mountPath: /opt/scm, readOnly: true} - {name: coordinator, mountPath: /opt/coordinator, readOnly: true} - {name: tmp, mountPath: /tmp} resources: requests: {cpu: 2m, memory: 64Mi} limits: {cpu: 250m, memory: 256Mi} volumes: - name: workspace persistentVolumeClaim: {claimName: workspace-hermes-execution-worker-2} - name: scm-state persistentVolumeClaim: {claimName: hermes-execution-mediator-state-2} - name: pool-access emptyDir: {medium: Memory, sizeLimit: 1Mi} - name: scm-broker-client configMap: {name: hermes-scm-boundary-v2, defaultMode: 0555} - name: coordinator configMap: {name: hermes-execution-pool, defaultMode: 0555} - name: tmp emptyDir: {sizeLimit: 64Mi} - name: vault-auth-token projected: defaultMode: 0600 sources: - serviceAccountToken: {audience: vault, expirationSeconds: 3600, path: token} - configMap: name: kube-root-ca.crt items: [{key: ca.crt, path: ca.crt}] - downwardAPI: items: [{path: namespace, fieldRef: {fieldPath: metadata.namespace}}]