# services/hermes/node-ssh-access.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: hermes-node-ssh-access
  namespace: hermes
  labels:
    app: hermes-node-ssh-access
spec:
  selector:
    matchLabels:
      app: hermes-node-ssh-access
  template:
    metadata:
      labels:
        app: hermes-node-ssh-access
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: hermes-node-ssh
        vault.hashicorp.com/agent-inject-secret-node-ssh-public-key: kv/data/atlas/hermes/developer-ssh
        vault.hashicorp.com/agent-inject-template-node-ssh-public-key: |
          {{- with secret "kv/data/atlas/hermes/developer-ssh" -}}
          {{ .Data.data.public_key }}
          {{- end }}
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/agent-init-first: "true"
    spec:
      serviceAccountName: hermes-node-ssh-access
      automountServiceAccountToken: true
      tolerations:
        - operator: Exists
      containers:
        - name: key-reconciler
          image: busybox:1.37
          imagePullPolicy: IfNotPresent
          command: [/bin/sh, -ec]
          args:
            - |
              reconcile() {
                key="$(cat /vault/secrets/node-ssh-public-key)"
                found=0
                for user in atlas oceanus; do
                  home="/host-home/${user}"
                  [ -d "${home}" ] || continue
                  found=1
                  install -d -m 0700 -o "$(stat -c %u "${home}")" -g "$(stat -c %g "${home}")" "${home}/.ssh"
                  touch "${home}/.ssh/authorized_keys"
                  grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
                  chown "$(stat -c %u "${home}"):$(stat -c %g "${home}")" "${home}/.ssh/authorized_keys"
                  chmod 0600 "${home}/.ssh/authorized_keys"
                done
                [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
              }
              while true; do
                reconcile
                sleep 300
              done
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsUser: 0
            runAsGroup: 0
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: host-home
              mountPath: /host-home
            - name: tmp
              mountPath: /tmp
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 32Mi
      volumes:
        - name: host-home
          hostPath:
            path: /home
            type: Directory
        - name: tmp
          emptyDir:
            sizeLimit: 8Mi