9d42ff33f5
Resolve 8 conflicts, uniting #16's daemonless image-release lane with #14's SCM broker + node-audit boundary. Nothing dropped from either side. - quality_coverage.py / test_quality_coverage_helpers.py: take main's dual-metric gate (line+branch enforced per file at minimum_percent); drop #14's now-dead branch_tracked_files/minimum_branch_percent keys. - quality_contract.json: union all lists (managed_modules, lint_paths, coverage_sources, tracked_files, hygiene globs) so #14's scm-broker, git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit are branch-checked alongside #16's image-builder modules. - Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's hermes-scm-broker role. Preserve #14's security property: hermes-agent no longer holds developer-gitea (broker role carries it). - agent-deployment.yaml / stage_runtime_access.py: keep #16's jenkins-image-build-token injection/staging; keep #14's removal of the agent's gitea-token/gitea-username. - Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test) so the merged auth config re-applies over any -9 already in-cluster. - flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
27 lines
599 B
YAML
27 lines
599 B
YAML
# clusters/atlas/flux-system/applications/vault/kustomization.yaml
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: vault
|
|
namespace: flux-system
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
namespace: flux-system
|
|
path: ./services/vault
|
|
targetNamespace: vault
|
|
prune: true
|
|
wait: true
|
|
healthChecks:
|
|
- apiVersion: batch/v1
|
|
kind: Job
|
|
name: vault-k8s-auth-hermes-10
|
|
namespace: vault
|
|
dependsOn:
|
|
- name: longhorn
|
|
- name: helm
|