7a55b259bf
Three fenced worker Pods claim Hermes Kanban runs through a coordinator that owns every state transition, with per-ordinal HMAC authority, a mediated broker-only SCM path, and durable per-ordinal workspaces. Content is the reviewed head of PR #18 (689bcb6e) with PR 16's and PR 19's contributions removed: they were merged in only to validate co-existence and are not prerequisites, so this branch no longer carries them as ancestors. Only PR 14 and PR 15 remain, because the broker boundary and the cli_lane_* decomposition are load-bearing for two of the fixed P0 boundaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
2.9 KiB
YAML
67 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hermes-agent
|
|
namespace: hermes
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject-secret-execution-pool-key: kv/data/atlas/hermes/agent-tokens
|
|
vault.hashicorp.com/agent-inject-perms-execution-pool-key: "0600"
|
|
vault.hashicorp.com/agent-inject-template-execution-pool-key: |
|
|
{{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
|
|
{{ printf "hermes-execution-pool-root-v2:%s" .Data.data.agent_api_key | sha256sum }}
|
|
{{- end }}
|
|
spec:
|
|
containers:
|
|
- name: cli-lane-runner
|
|
env:
|
|
- {name: HERMES_CLI_LANE_OWNED_WORKSPACES_ONLY, value: "true"}
|
|
- {name: HERMES_CLI_LANE_CONCURRENCY, value: "1"}
|
|
- name: execution-pool-coordinator
|
|
image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
|
|
imagePullPolicy: IfNotPresent
|
|
command: [/opt/hermes/.venv/bin/python, /opt/coordinator/execution_pool_coordinator.py]
|
|
env:
|
|
- {name: HERMES_HOME, value: /opt/data}
|
|
- {name: HOME, value: /opt/data/home}
|
|
- {name: PYTHONPATH, value: /opt/hermes}
|
|
- {name: HERMES_EXECUTION_POOL_KEY_FILE, value: /pool-access/execution-pool-key}
|
|
- {name: PATH, value: /opt/coordinator:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: [ALL]}
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10000
|
|
runAsGroup: 10000
|
|
seccompProfile: {type: RuntimeDefault}
|
|
volumeMounts:
|
|
- {name: home, mountPath: /opt/data}
|
|
- {name: runtime-access, mountPath: /pool-access/execution-pool-key, subPath: execution-pool-key, readOnly: true}
|
|
- {name: execution-pool-code, mountPath: /opt/coordinator, readOnly: true}
|
|
- {name: auth-patch, mountPath: /opt/hermes/hermes_cli/auth.py, subPath: auth.py}
|
|
- {name: tmp, mountPath: /tmp}
|
|
ports:
|
|
- {name: execution-pool, containerPort: 9007, protocol: TCP}
|
|
startupProbe:
|
|
httpGet: {path: /ready, port: execution-pool}
|
|
periodSeconds: 5
|
|
failureThreshold: 60
|
|
readinessProbe:
|
|
httpGet: {path: /ready, port: execution-pool}
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: {path: /ready, port: execution-pool}
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
resources:
|
|
requests: {cpu: 50m, memory: 128Mi}
|
|
limits: {cpu: 500m, memory: 512Mi}
|
|
volumes:
|
|
- name: execution-pool-code
|
|
configMap:
|
|
name: hermes-execution-pool
|
|
defaultMode: 0555
|