# services/hermes/node-ssh-access.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: hermes-node-ssh
    objects: |
      - objectName: "node-ssh-public-key"
        secretPath: "kv/data/atlas/hermes/developer-ssh"
        secretKey: "public_key"
        filePermission: 256
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
spec:
  selector:
    matchLabels:
      app: hermes-node-ssh-access
  template:
    metadata:
      labels:
        app: hermes-node-ssh-access
    spec:
      serviceAccountName: hermes-node-ssh-access
      automountServiceAccountToken: true
      tolerations:
        - operator: Exists
      containers:
        - name: key-reconciler
          # The pinned index supports the cluster's amd64 and arm64 nodes.
          image: python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - |
              while true; do
                /usr/local/bin/python \
                  /opt/node-hardener/node_account_hardening.py \
                  --public-key-file /vault/secrets/node-ssh-public-key
                sleep 300
              done
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 0
            runAsGroup: 0
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: host-home
              mountPath: /host-home
            - name: host-etc
              mountPath: /host-etc
            - name: host-polkit-share
              mountPath: /host-polkit-share
              readOnly: true
            - name: host-k3s
              mountPath: /host-k3s
            - name: host-kubelet
              mountPath: /host-kubelet
            - name: host-run-k3s
              mountPath: /host-run-k3s
            - name: host-run-containerd
              mountPath: /host-run-containerd
            - name: coordinator
              mountPath: /opt/node-hardener
              readOnly: true
            - name: vault-secrets
              mountPath: /vault/secrets
              readOnly: true
            - name: tmp
              mountPath: /tmp
          resources:
            requests:
              cpu: 5m
              memory: 32Mi
            limits:
              cpu: 50m
              memory: 128Mi
      volumes:
        - name: host-home
          hostPath:
            path: /home
            type: Directory
        - name: host-etc
          hostPath:
            path: /etc
            type: Directory
        - name: host-polkit-share
          hostPath:
            path: /usr/share/polkit-1
            type: Directory
        - name: host-k3s
          hostPath:
            path: /var/lib/rancher/k3s
            type: Directory
        - name: host-kubelet
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: host-run-k3s
          hostPath:
            path: /run/k3s
            type: Directory
        - name: host-run-containerd
          hostPath:
            path: /run/containerd
            type: Directory
        - name: coordinator
          configMap:
            name: hermes-node-account-hardener
            defaultMode: 0555
        - name: vault-secrets
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: hermes-node-ssh-access
        - name: tmp
          emptyDir:
            sizeLimit: 8Mi