71c05cf9c0
Activation (not yet pushed): per-tenant HUX sidecar on the exact live WebUI image, standalone Astreae RWX PVC with kubelet subPathExpr per-pod isolation, root init container that provisions 0700 tenant roots, a persistent HMAC context key, an immutable subject binding and tmpfs relay/worker keys, the vendored hux-runtime plugin ConfigMap, and observe-only defaults (HUX_TOOL_ENFORCEMENT=0). Delivery tests pin the whole boundary; image-automation tests bind the HUX metadata setters. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
80 lines
1.6 KiB
YAML
80 lines
1.6 KiB
YAML
# services/hermes/chat-pvcs.yaml
|
|
# Existing tenant claims are explicit so Flux can expand them with the template.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: home-hermes-chat-tenant-0
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-chat-tenant
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: astreae
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
# HUX tenants share the backing claim but only receive their pod-specific
|
|
# subdirectory through kubelet subPath mounts.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: hermes-chat-hux-data
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-chat-tenant
|
|
ai.bstein.dev/data: tenant-hux-ledger
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: astreae
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: home-hermes-chat-tenant-1
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-chat-tenant
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: astreae
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: home-hermes-chat-tenant-2
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-chat-tenant
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: astreae
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: home-hermes-chat-tenant-3
|
|
namespace: hermes
|
|
labels:
|
|
app: hermes-chat-tenant
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: astreae
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|