apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-agent
  namespace: hermes
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject-secret-execution-pool-key: kv/data/atlas/hermes/agent-tokens
        vault.hashicorp.com/agent-inject-perms-execution-pool-key: "0600"
        vault.hashicorp.com/agent-inject-template-execution-pool-key: |
          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
          {{ printf "hermes-execution-pool-root-v2:%s" .Data.data.agent_api_key | sha256Hex }}
          {{- end }}
    spec:
      containers:
        - name: cli-lane-runner
          env:
            - {name: HERMES_CLI_LANE_OWNED_WORKSPACES_ONLY, value: "true"}
            - {name: HERMES_CLI_LANE_CONCURRENCY, value: "1"}
        - name: execution-pool-coordinator
          image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
          imagePullPolicy: IfNotPresent
          command: [/opt/hermes/.venv/bin/python, /opt/coordinator/execution_pool_coordinator.py]
          env:
            - {name: HERMES_HOME, value: /opt/data}
            - {name: HOME, value: /opt/data/home}
            - {name: PYTHONPATH, value: /opt/hermes}
            - {name: HERMES_EXECUTION_POOL_KEY_FILE, value: /pool-access/execution-pool-key}
            - {name: PATH, value: /opt/coordinator:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: [ALL]}
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 10000
            runAsGroup: 10000
            seccompProfile: {type: RuntimeDefault}
          volumeMounts:
            - {name: home, mountPath: /opt/data}
            - {name: runtime-access, mountPath: /pool-access/execution-pool-key, subPath: execution-pool-key, readOnly: true}
            - {name: execution-pool-code, mountPath: /opt/coordinator, readOnly: true}
            - {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
            - {name: tmp, mountPath: /tmp}
          ports:
            - {name: execution-pool, containerPort: 9007, protocol: TCP}
          startupProbe:
            httpGet: {path: /ready, port: execution-pool}
            periodSeconds: 5
            failureThreshold: 60
          readinessProbe:
            httpGet: {path: /ready, port: execution-pool}
            periodSeconds: 10
          livenessProbe:
            httpGet: {path: /ready, port: execution-pool}
            initialDelaySeconds: 30
            periodSeconds: 30
          resources:
            requests: {cpu: 50m, memory: 128Mi}
            limits: {cpu: 500m, memory: 512Mi}
      volumes:
        - name: execution-pool-code
          configMap:
            name: hermes-execution-pool
            defaultMode: 0555