9d42ff33f5
Resolve 8 conflicts, uniting #16's daemonless image-release lane with #14's SCM broker + node-audit boundary. Nothing dropped from either side. - quality_coverage.py / test_quality_coverage_helpers.py: take main's dual-metric gate (line+branch enforced per file at minimum_percent); drop #14's now-dead branch_tracked_files/minimum_branch_percent keys. - quality_contract.json: union all lists (managed_modules, lint_paths, coverage_sources, tracked_files, hygiene globs) so #14's scm-broker, git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit are branch-checked alongside #16's image-builder modules. - Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's hermes-scm-broker role. Preserve #14's security property: hermes-agent no longer holds developer-gitea (broker role carries it). - agent-deployment.yaml / stage_runtime_access.py: keep #16's jenkins-image-build-token injection/staging; keep #14's removal of the agent's gitea-token/gitea-username. - Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test) so the merged auth config re-applies over any -9 already in-cluster. - flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
66 lines
1.6 KiB
YAML
66 lines
1.6 KiB
YAML
# clusters/atlas/flux-system/applications/hermes/kustomization.yaml
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: hermes
|
|
namespace: flux-system
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/ssa: Merge
|
|
spec:
|
|
interval: 10m
|
|
path: ./services/hermes
|
|
targetNamespace: hermes
|
|
prune: true
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
namespace: flux-system
|
|
wait: false
|
|
timeout: 10m
|
|
healthChecks:
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: hermes-model-gate
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: hermes-switchyard
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: hermes-agent
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
name: hermes-node-ssh-access
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: hermes
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
name: hermes-chat-tenant
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: hermes-chat-router
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: oauth2-proxy-hermes-chat
|
|
namespace: hermes
|
|
- apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: oauth2-proxy-hermes-triage
|
|
namespace: hermes
|
|
dependsOn:
|
|
- name: cert-manager
|
|
- name: core
|
|
- name: keycloak
|
|
- name: longhorn
|
|
- name: vault
|
|
- name: jenkins
|
|
- name: hermes-scm-broker
|
|
- name: hermes-observer-rbac
|