atlas-iac/services/hermes/kustomization.yaml

# services/hermes/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: hermes
images:
  - name: registry.bstein.dev/bstein/hermes-agent
    digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7
resources:
  - namespace.yaml
  - vault-serviceaccount.yaml
  - configmap.yaml
  - agent-configmap.yaml
  - chat-configmap.yaml
  - switchyard-configmap.yaml
  - rbac.yaml
  - agent-rbac.yaml
  - node-ssh-access.yaml
  - pvc.yaml
  - switchyard-pvc.yaml
  - routing-catalog-pvc.yaml
  - chat-pvcs.yaml
  - oauth-session-store.yaml
  - model-gate-rbac.yaml
  - local-image-rbac.yaml
  - ariadne-handoff-rbac.yaml
  - model-gate-state.yaml
  - model-gate-configmap.yaml
  - model-gate-deployment.yaml
  - switchyard-deployment.yaml
  - image-policy-configmap.yaml
  - networkpolicy.yaml
  - local-image-deployment.yaml
  - deployment.yaml
  - agent-deployment.yaml
  - voice-deployment.yaml
  - chat-statefulset.yaml
  - chat-sandbox.yaml
  - chat-router.yaml
  - service.yaml
  - switchyard-service.yaml
  - oauth2-proxy.yaml
  - agent-certificate.yaml
  - agent-ingress.yaml

configMapGenerator:
  - name: hermes-chat-oauth-templates
    namespace: hermes
    files:
      - error.html=oauth2-proxy-templates/error.html
    options:
      disableNameSuffixHash: true
  - name: hermes-operator-guide
    namespace: hermes
    files:
      - OPERATOR-RUNBOOK.md=NOTES.md
    options:
      disableNameSuffixHash: true
  - name: hermes-coordinator
    namespace: hermes
    files:
      - claude=scripts/claude
      - claude_command_policy.py=scripts/claude_command_policy.py
      - cli_lane_runner.py=scripts/cli_lane_runner.py
      - codex=scripts/codex
      - configure_agent_clients.py=scripts/configure_agent_clients.py
      - codex_broker.py=scripts/codex_broker.py
      - classifier_broker.py=scripts/classifier_broker.py
      - claude_oauth_broker.py=scripts/claude_oauth_broker.py
      - worker_route_broker.py=scripts/worker_route_broker.py
      - gitea_askpass.sh=scripts/gitea_askpass.sh
      - hermes_coordinator.py=scripts/hermes_coordinator.py
      - hermes_model_routing.py=scripts/hermes_model_routing.py
      - hermes_stt_client.py=scripts/hermes_stt_client.py
      - image_broker.py=scripts/image_broker.py
      - install_agent_tools.sh=scripts/install_agent_tools.sh
      - kanban_status_recovery.py=scripts/kanban_status_recovery.py
      - migrate_herdr_state.py=scripts/migrate_herdr_state.py
      - migrate_api_session_lineage.py=scripts/migrate_api_session_lineage.py
      - patch_api_server_sessions.py=scripts/patch_api_server_sessions.py
      - patch_web_session_activity.py=scripts/patch_web_session_activity.py
      - patch_subprocess_secret_boundary.py=scripts/patch_subprocess_secret_boundary.py
      - patch_process_output_redaction.py=scripts/patch_process_output_redaction.py
      - stage_runtime_access.py=scripts/stage_runtime_access.py
      - sync_runtime_credentials.py=scripts/sync_runtime_credentials.py
      - patch_hermes_auth.py=scripts/patch_hermes_auth.py
      - patch_codex_runtime.py=scripts/patch_codex_runtime.py
      - patch_stream_recovery.py=scripts/patch_stream_recovery.py
      - patch_tui_gateway.py=scripts/patch_tui_gateway.py
      - patch_ttyd_index.py=scripts/patch_ttyd_index.py
      - repair_cassandra_kanban.py=scripts/repair_cassandra_kanban.py
      - recover_cassandra_workers.py=scripts/recover_cassandra_workers.py
      - routing_catalog.py=scripts/routing_catalog.py
      - telegram_media_server.py=scripts/telegram_media_server.py
    options:
      disableNameSuffixHash: true
  - name: hermes-agent-kubeconfig
    namespace: hermes
    files:
      - config=agent-kubeconfig.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-auto-router-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/auto-router/__init__.py
      - provider_status.py=plugins/auto-router/provider_status.py
      - plugin.yaml=plugins/auto-router/plugin.yaml
      - dashboard-manifest.json=plugins/auto-router/dashboard/manifest.json
      - dashboard-api.py=plugins/auto-router/dashboard/plugin_api.py
      - dashboard-index.js=plugins/auto-router/dashboard/dist/index.js
      - dashboard-style.css=plugins/auto-router/dashboard/dist/style.css
    options:
      disableNameSuffixHash: true
  - name: hermes-chat-image-plugin
    namespace: hermes
    files:
      - __init__.py=plugins/image-gen-broker/__init__.py
      - plugin.yaml=plugins/image-gen-broker/plugin.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-triage-skill
    namespace: hermes
    files:
      - SKILL.md=skills/triage-titan-test-failures/SKILL.md
      - openai.yaml=skills/triage-titan-test-failures/agents/openai.yaml
    options:
      disableNameSuffixHash: true
  - name: hermes-mastery-skill
    namespace: hermes
    files:
      - SKILL.md=skills/master-hermes-on-atlas/SKILL.md
      - openai.yaml=skills/master-hermes-on-atlas/agents/openai.yaml
      - architecture.md=skills/master-hermes-on-atlas/references/architecture.md
      - curriculum.md=skills/master-hermes-on-atlas/references/curriculum.md
      - incident-drills.md=skills/master-hermes-on-atlas/references/incident-drills.md
      - mastery-rubric.md=skills/master-hermes-on-atlas/references/mastery-rubric.md
      - two-hour-proof-sprint.md=skills/master-hermes-on-atlas/references/two-hour-proof-sprint.md
    options:
      disableNameSuffixHash: true
  - name: hermes-service-health-skill
    namespace: hermes
    files:
      - SKILL.md=skills/triage-atlas-service-health/SKILL.md
      - openai.yaml=skills/triage-atlas-service-health/agents/openai.yaml
      - service-map.md=skills/triage-atlas-service-health/references/service-map.md
    options:
      disableNameSuffixHash: true
  - name: hermes-alert-tuning-skill
    namespace: hermes
    files:
      - SKILL.md=skills/tune-atlas-alerts/SKILL.md
      - openai.yaml=skills/tune-atlas-alerts/agents/openai.yaml
      - alert-review.md=skills/tune-atlas-alerts/references/alert-review.md
    options:
      disableNameSuffixHash: true