paperclip: rotate agent-hestia/hermes/atlas SA tokens via rename (REN-509) #1103

2026-10-03T06:37:04Z

Ghost commented

2026-10-03 06:37:04 +00:00

What

Renames three ServiceAccount token Secrets in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:

agent-hestia-token → agent-hestia-token-v2
agent-hermes-token → agent-hermes-token-v2
agent-atlas-token → agent-atlas-token-v2

The SA annotation and type kubernetes.io/service-account-token stay the same. Role agent-token-read resourceNames lists the -v2 names and drops the old ones. Iris and Argus tokens are unchanged.

Why

REN-509 / REN-505: these three tokens leaked into run logs (REN-483, REN-484, REN-507) and are burned. Kustomization paperclip has prune: true, so Flux deletes the old Secrets. The token controller creates new tokens for the -v2 Secrets, and the legacy tokens stop working.

Impact

Hestia, Hermes and Atlas lose kubectl access through their old kubeconfigs until Hermes hands out new ones. This is intended.
No pod mounts these Secrets (git grep finds no other reference). No workload restart, no Home Assistant impact, no ingress or traffic change, so the HA window does not apply.

Verified

Diff: 6 lines in a single file.
Live Kustomization paperclip: Ready, rev bb94b49b, interval 10m, prune true. The inventory holds all three old Secrets, so Flux will prune them.

After merge

Run flux reconcile ks paperclip, or wait 10m. Then check that the inventory lists the -v2 Secrets and not the old ones, and that the -v2 Secrets have a token. Then hand off to Hermes for kubeconfigs and the 401 check.

Revert

Revert this commit. Flux recreates the old names with new tokens; the burned tokens do not come back.

🤖 Generated with Claude Code

## What Renames three ServiceAccount token Secrets in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml`: - `agent-hestia-token` → `agent-hestia-token-v2` - `agent-hermes-token` → `agent-hermes-token-v2` - `agent-atlas-token` → `agent-atlas-token-v2` The SA annotation and type `kubernetes.io/service-account-token` stay the same. Role `agent-token-read` `resourceNames` lists the `-v2` names and drops the old ones. Iris and Argus tokens are unchanged. ## Why REN-509 / REN-505: these three tokens leaked into run logs (REN-483, REN-484, REN-507) and are burned. Kustomization `paperclip` has `prune: true`, so Flux deletes the old Secrets. The token controller creates new tokens for the `-v2` Secrets, and the legacy tokens stop working. ## Impact - Hestia, Hermes and Atlas lose kubectl access through their old kubeconfigs until Hermes hands out new ones. This is intended. - No pod mounts these Secrets (`git grep` finds no other reference). No workload restart, no Home Assistant impact, no ingress or traffic change, so the HA window does not apply. ## Verified - Diff: 6 lines in a single file. - Live Kustomization `paperclip`: Ready, rev `bb94b49b`, interval 10m, prune true. The inventory holds all three old Secrets, so Flux will prune them. ## After merge Run `flux reconcile ks paperclip`, or wait 10m. Then check that the inventory lists the `-v2` Secrets and not the old ones, and that the `-v2` Secrets have a token. Then hand off to Hermes for kubeconfigs and the 401 check. ## Revert Revert this commit. Flux recreates the old names with **new** tokens; the burned tokens do not come back. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-10-03 06:37:05 +00:00

paperclip: rotate agent-hestia/hermes/atlas SA token Secrets via rename (REN-509)

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline failed

Details

a59810d351

The three tokens leaked into run logs (REN-483, REN-484, REN-507).
Renaming makes the token controller mint new tokens; Flux prunes the
old Secrets, which invalidates the legacy tokens.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot reviewed

2026-10-03 06:39:01 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit a59810d351ce7629b096db15ecdfca419e1f5619.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Renames three ServiceAccount token Secrets (agent-atlas-token, agent-hestia-token, agent-hermes-token) to -v2 suffixes in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml, to rotate tokens that leaked into logs. The agent-token-read Role's resourceNames list is updated to match. This is a clean, minimal, mechanical rename with no blocking issues.

🟡 Suggestions

kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:188-193: The resourceNames list is now inconsistent in naming (agent-atlas-token-v2, agent-iris-token, agent-hestia-token-v2, agent-argus-token, agent-hermes-token-v2) — three -v2 suffixes mixed with two bare names. This is correct today but is a bit of latent confusion for the next reader/rotation; a one-line comment noting that iris/argus are intentionally unrotated (as the PR body already explains) would help, since the file's existing block comment (lines 1-23) doesn't mention the -v2 scheme at all.

Tests

No automated tests apply to this kind of static manifest change (this repo doesn't appear to have a test suite over Kustomize YAML). Verification here is operational (confirmed in the PR description: live Kustomization is Ready, prune: true, and the inventory holds the old Secret names so Flux will prune them on reconcile). I independently verified:

All three Secret metadata.name fields match their corresponding entries in the agent-token-read Role's resourceNames (lines 74, 96, 118 vs. 189, 191, 193).
The kubernetes.io/service-account.name annotations on each renamed Secret are untouched and still point at the correct ServiceAccount (agent-atlas, agent-hestia, agent-hermes).
agent-iris-token and agent-argus-token are correctly left unrotated, matching the PR's claim that only Hestia/Hermes/Atlas tokens leaked.
A repo-wide grep for the old names (agent-atlas-token, agent-hestia-token, agent-hermes-token) turns up only this one file, confirming the PR body's claim that no pod or other manifest references the old Secret names.
kubernetes/apps/paperclip/kustomization.yaml already lists agent-kubectl-rbac.yaml, so no kustomization wiring changes are needed.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `a59810d351ce7629b096db15ecdfca419e1f5619`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Renames three ServiceAccount token Secrets (`agent-atlas-token`, `agent-hestia-token`, `agent-hermes-token`) to `-v2` suffixes in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml`, to rotate tokens that leaked into logs. The `agent-token-read` Role's `resourceNames` list is updated to match. This is a clean, minimal, mechanical rename with no blocking issues. ## 🟡 Suggestions - `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:188-193`: The `resourceNames` list is now inconsistent in naming (`agent-atlas-token-v2`, `agent-iris-token`, `agent-hestia-token-v2`, `agent-argus-token`, `agent-hermes-token-v2`) — three `-v2` suffixes mixed with two bare names. This is correct today but is a bit of latent confusion for the next reader/rotation; a one-line comment noting that `iris`/`argus` are intentionally unrotated (as the PR body already explains) would help, since the file's existing block comment (lines 1-23) doesn't mention the `-v2` scheme at all. ## Tests No automated tests apply to this kind of static manifest change (this repo doesn't appear to have a test suite over Kustomize YAML). Verification here is operational (confirmed in the PR description: live Kustomization is `Ready`, `prune: true`, and the inventory holds the old Secret names so Flux will prune them on reconcile). I independently verified: - All three Secret `metadata.name` fields match their corresponding entries in the `agent-token-read` Role's `resourceNames` (lines 74, 96, 118 vs. 189, 191, 193). - The `kubernetes.io/service-account.name` annotations on each renamed Secret are untouched and still point at the correct ServiceAccount (`agent-atlas`, `agent-hestia`, `agent-hermes`). - `agent-iris-token` and `agent-argus-token` are correctly left unrotated, matching the PR's claim that only Hestia/Hermes/Atlas tokens leaked. - A repo-wide grep for the old names (`agent-atlas-token`, `agent-hestia-token`, `agent-hermes-token`) turns up only this one file, confirming the PR body's claim that no pod or other manifest references the old Secret names. - `kubernetes/apps/paperclip/kustomization.yaml` already lists `agent-kubectl-rbac.yaml`, so no kustomization wiring changes are needed. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

Ghost approved these changes

2026-10-03 06:39:03 +00:00

Ghost left a comment

Approved at a59810d351 (REN-509). Diff: 3 Secret renames + Role resourceNames; SA annotations and type unchanged. git grep: no other refs to old names. Live ks paperclip: prune=true, Ready, inventory holds the 3 old Secrets; no paperclip pod references them. Revert recreates names with fresh tokens.

Approved at a59810d351ce7629b096db15ecdfca419e1f5619 (REN-509). Diff: 3 Secret renames + Role resourceNames; SA annotations and type unchanged. git grep: no other refs to old names. Live ks paperclip: prune=true, Ready, inventory holds the 3 old Secrets; no paperclip pod references them. Revert recreates names with fresh tokens.

Ghost merged commit 080ef16b9d into master

2026-10-03 06:39:04 +00:00

Ghost referenced this issue from a commit

2026-10-03 06:39:05 +00:00

Merge pull request 'paperclip: rotate agent-hestia/hermes/atlas SA tokens via rename (REN-509)' (#1103) from atlas/ren-509-rotate-agent-tokens into master

Ghost referenced this pull request

2026-10-03 14:46:33 +00:00

paperclip: rotate agent-argus SA token Secret via rename (REN-525) #1104

Ghost referenced this pull request

2026-10-03 16:48:39 +00:00

fix(paperclip): rotate agent-atlas SA token Secret to -v3 (REN-539) #1109

Sign in to join this conversation.