0a4ff7f1f6
The Vault CSI secrets-store projects /vault/secrets/node-ssh-public-key as a symlink chain (file -> ..data/file -> ..<timestamp>/file), which the O_NOFOLLOW hardened reader refuses with ELOOP, crash-looping the hermes-node-ssh-access key reconciler on most nodes. Resolve the projection safely instead of relaxing the reader: realpath the secret strictly (loops and dangling links become a clean refusal), refuse any resolution that escapes the read-only mount, then apply the unchanged O_NOFOLLOW regular-file read to the resolved target. Host account databases and authorized_keys keep the strict no-symlink read. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
titan-iac
Flux-managed Kubernetes desired-state config for bstein.dev.
Canonical source URL:
ssh://git@scm.bstein.dev:2242/atlas/titan-iac.git
Scope
This repo contains cluster configuration consumed by Flux:
- platform/infrastructure manifests
- service manifests and kustomizations
- operational scripts for render/reconcile workflows
Apply model
I use Git + Flux as the source of truth and avoid manual in-cluster edits for durable changes.