39a544828f
Some checks failed
Tests / Declarative: Post Actions failed: 71, skipped: 28, passed: 3680
Re-applies the staged HUX topology pinned to the reviewed build-21 image (git-2f535d3a...-build-21-release@sha256:e5b9b2fa...), with the first-activation posture: HUX_FLAGS=hux.foundation only, HUX_TOOL_ENFORCEMENT=0, and a RollingUpdate partition of 3 so only hermes-chat-tenant-3 rolls. Adds the /healthz auth bypass on the chat proxy so HUX-12 health receipts can observe a real 200, points the evidence policy at it, and makes the delivery flag gate progressive (foundation first, cards enabled per lifecycle acceptance; unknown flags still never ship). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
# services/hermes/hux-evidence-rbac.yaml
|
|
# Read-only facts for the HUX-12 evidence producer sidecar: Ready pod
|
|
# imageIDs and the desired StatefulSet image in this namespace, plus the
|
|
# single named Flux Kustomization's applied revision. The pod service
|
|
# account gains nothing writable and nothing secret.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: hermes-hux-evidence-read
|
|
namespace: hermes
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: [pods]
|
|
verbs: [get, list]
|
|
- apiGroups: [apps]
|
|
resources: [statefulsets]
|
|
verbs: [get]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: hermes-hux-evidence-read
|
|
namespace: hermes
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: hermes-hux-evidence-read
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: hermes-chat
|
|
namespace: hermes
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: hermes-hux-evidence-kustomization-read
|
|
rules:
|
|
- apiGroups: [kustomize.toolkit.fluxcd.io]
|
|
resources: [kustomizations]
|
|
resourceNames: [hermes]
|
|
verbs: [get]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: hermes-hux-evidence-kustomization-read
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: hermes-hux-evidence-kustomization-read
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: hermes-chat
|
|
namespace: hermes
|