# services/vault/hermes-model-gate-lan-token-seed-job.yaml
# Purpose: create-only seed of the model-gate LAN API bearer token at
# kv/atlas/hermes/model-gate-lan-api (field: token). KV-v2 CAS create
# semantics -- an existing token is never overwritten. The script waits for
# the vault-k8s-auth-config CronJob (every 15 minutes) to write the seeder
# auth role, so a fresh merge does not fail the Job on the role race.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hermes-model-gate-lan-token-seed
  namespace: vault
---
apiVersion: batch/v1
kind: Job
metadata:
  name: vault-hermes-model-gate-lan-token-seed-1
  namespace: vault
spec:
  backoffLimit: 2
  template:
    spec:
      serviceAccountName: hermes-model-gate-lan-token-seed
      enableServiceLinks: false
      restartPolicy: Never
      nodeSelector:
        hardware: rpi5
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/hostname
                    operator: NotIn
                    values: [titan-04, titan-14, titan-18, titan-19, titan-24]
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: seed
          image: docker.io/hashicorp/vault@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
          imagePullPolicy: IfNotPresent
          command: [sh, /scripts/vault_hermes_model_gate_lan_token_ensure.sh]
          env:
            - name: HOME
              value: /tmp
            - name: VAULT_ADDR
              value: http://vault.vault.svc.cluster.local:8200
            - name: VAULT_K8S_ROLE
              value: hermes-model-gate-lan-token-seed
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsNonRoot: true
            runAsUser: 100
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: scripts
              mountPath: /scripts
              readOnly: true
            - name: tmp
              mountPath: /tmp
          resources:
            requests: {cpu: 25m, memory: 32Mi}
            limits: {cpu: 250m, memory: 128Mi}
      volumes:
        - name: scripts
          configMap:
            name: vault-hermes-model-gate-lan-token-seed-script
            defaultMode: 0555
        - name: tmp
          emptyDir: {}