9d42ff33f5
Resolve 8 conflicts, uniting #16's daemonless image-release lane with #14's SCM broker + node-audit boundary. Nothing dropped from either side. - quality_coverage.py / test_quality_coverage_helpers.py: take main's dual-metric gate (line+branch enforced per file at minimum_percent); drop #14's now-dead branch_tracked_files/minimum_branch_percent keys. - quality_contract.json: union all lists (managed_modules, lint_paths, coverage_sources, tracked_files, hygiene globs) so #14's scm-broker, git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit are branch-checked alongside #16's image-builder modules. - Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's hermes-scm-broker role. Preserve #14's security property: hermes-agent no longer holds developer-gitea (broker role carries it). - agent-deployment.yaml / stage_runtime_access.py: keep #16's jenkins-image-build-token injection/staging; keep #14's removal of the agent's gitea-token/gitea-username. - Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test) so the merged auth config re-applies over any -9 already in-cluster. - flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
80 lines
2.5 KiB
YAML
80 lines
2.5 KiB
YAML
# services/vault/hermes-auth-role-bootstrap-job.yaml
|
|
# Purpose: apply the Vault read/write boundaries needed by Hermes operator OIDC.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: vault-k8s-auth-hermes-10
|
|
namespace: vault
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
serviceAccountName: vault-admin
|
|
restartPolicy: Never
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values: [titan-04, titan-14, titan-18, titan-19, titan-24]
|
|
containers:
|
|
- name: configure-k8s-auth
|
|
image: docker.io/hashicorp/vault@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- sh
|
|
- /scripts/vault_k8s_auth_configure.sh
|
|
env:
|
|
- name: HOME
|
|
value: /tmp
|
|
- name: VAULT_ADDR
|
|
value: http://vault.vault.svc.cluster.local:8200
|
|
- name: VAULT_K8S_ROLE
|
|
value: vault-admin
|
|
- name: VAULT_K8S_TOKEN_REVIEWER_JWT_FILE
|
|
value: /var/run/secrets/vault-token-reviewer/token
|
|
- name: VAULT_K8S_ROLE_TTL
|
|
value: 1h
|
|
volumeMounts:
|
|
- name: k8s-auth-config-script
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
- name: token-reviewer
|
|
mountPath: /var/run/secrets/vault-token-reviewer
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 100
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: k8s-auth-config-script
|
|
configMap:
|
|
name: vault-k8s-auth-config-script
|
|
defaultMode: 0555
|
|
- name: token-reviewer
|
|
secret:
|
|
secretName: vault-admin-token-reviewer
|
|
- name: tmp
|
|
emptyDir: {}
|