From a59810d351ce7629b096db15ecdfca419e1f5619 Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sat, 3 Oct 2026 06:36:55 +0000 Subject: [PATCH] paperclip: rotate agent-hestia/hermes/atlas SA token Secrets via rename (REN-509) The three tokens leaked into run logs (REN-483, REN-484, REN-507). Renaming makes the token controller mint new tokens; Flux prunes the old Secrets, which invalidates the legacy tokens. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/paperclip/agent-kubectl-rbac.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml index fb19cd82..091e4ace 100644 --- a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml +++ b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml @@ -71,7 +71,7 @@ apiVersion: v1 kind: Secret type: kubernetes.io/service-account-token metadata: - name: agent-atlas-token + name: agent-atlas-token-v2 namespace: paperclip labels: app.kubernetes.io/name: paperclip @@ -93,7 +93,7 @@ apiVersion: v1 kind: Secret type: kubernetes.io/service-account-token metadata: - name: agent-hestia-token + name: agent-hestia-token-v2 namespace: paperclip labels: app.kubernetes.io/name: paperclip @@ -115,7 +115,7 @@ apiVersion: v1 kind: Secret type: kubernetes.io/service-account-token metadata: - name: agent-hermes-token + name: agent-hermes-token-v2 namespace: paperclip labels: app.kubernetes.io/name: paperclip @@ -186,11 +186,11 @@ rules: resources: ["secrets"] verbs: ["get"] resourceNames: - - agent-atlas-token + - agent-atlas-token-v2 - agent-iris-token - - agent-hestia-token + - agent-hestia-token-v2 - agent-argus-token - - agent-hermes-token + - agent-hermes-token-v2 --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding