paperclip: rotate agent-argus SA token Secret via rename (REN-525) #1104

2026-10-03T14:46:33Z

Ghost commented

2026-10-03 14:46:33 +00:00

What

Rename Secret paperclip/agent-argus-token to agent-argus-token-v2 (type kubernetes.io/service-account-token, SA agent-argus) and update the agent-token-read Role resourceNames. Same pattern as REN-509 (#1103).

Why

The old token was printed in Argus run 373367ed (REN-523) and is burned. The token controller mints a new token for -v2; Flux prunes the old Secret, which invalidates the old token.

Verified

Diff only; 2 lines in one file. Lint only, not yet in the cluster. After merge: agent-argus-token absent, agent-argus-token-v2 present (checked on REN-525). Argus loses cluster access until Hermes rotates its KUBECONFIG_CONTENT (REN-524), accepted.

Revert

Revert this commit. Note a revert recreates agent-argus-token with a new token value, not the leaked one.

🤖 Generated with Claude Code

## What Rename Secret `paperclip/agent-argus-token` to `agent-argus-token-v2` (type `kubernetes.io/service-account-token`, SA `agent-argus`) and update the `agent-token-read` Role resourceNames. Same pattern as REN-509 (#1103). ## Why The old token was printed in Argus run 373367ed (REN-523) and is burned. The token controller mints a new token for `-v2`; Flux prunes the old Secret, which invalidates the old token. ## Verified Diff only; 2 lines in one file. Lint only, not yet in the cluster. After merge: `agent-argus-token` absent, `agent-argus-token-v2` present (checked on REN-525). Argus loses cluster access until Hermes rotates its KUBECONFIG_CONTENT (REN-524), accepted. ## Revert Revert this commit. Note a revert recreates `agent-argus-token` with a new token value, not the leaked one. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-10-03 14:46:33 +00:00

paperclip: rotate agent-argus SA token Secret via rename (REN-525)

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline failed

Details

8f98d267c6

The token leaked into Argus run 373367ed (REN-523). Renaming makes the
token controller mint a new token; Flux prunes the old Secret, which
invalidates the legacy token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot reviewed

2026-10-03 14:49:41 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 8f98d267c64233c6f6ed72ad7932f6056af20af5.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Renames the agent-argus service-account-token Secret from agent-argus-token to agent-argus-token-v2 and updates the matching resourceNames entry in the agent-token-read Role, mirroring the -v2 rotation pattern already applied to agent-atlas-token-v2, agent-hestia-token-v2, and agent-hermes-token-v2 in the same file (kubernetes/apps/paperclip/agent-kubectl-rbac.yaml). The change is minimal, internally consistent, and matches the file's established convention.

No blocking issues found.

🟡 Suggestions

kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:107 / :192 — confirmed via grep that agent-argus-token (old name) has no other references anywhere else in the repo, so this rename is self-contained; no dangling references to clean up elsewhere (e.g. Hermes kubeconfig tooling, docs). Nothing to change, just noting it was checked.
PR body notes Argus loses cluster access until Hermes rotates KUBECONFIG_CONTENT (REN-524) and treats that as accepted/expected — worth double-checking that REN-524 is actually in flight/scheduled before merging this, since otherwise Argus is down with no tracked follow-up.

Tests

No test suite applies to this kind of static RBAC/Secret-name YAML change; the PR description's own verification steps (lint, post-merge check that agent-argus-token is absent and agent-argus-token-v2 is present) are the appropriate verification method here and are reasonable.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `8f98d267c64233c6f6ed72ad7932f6056af20af5`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Renames the `agent-argus` service-account-token Secret from `agent-argus-token` to `agent-argus-token-v2` and updates the matching `resourceNames` entry in the `agent-token-read` Role, mirroring the `-v2` rotation pattern already applied to `agent-atlas-token-v2`, `agent-hestia-token-v2`, and `agent-hermes-token-v2` in the same file (`kubernetes/apps/paperclip/agent-kubectl-rbac.yaml`). The change is minimal, internally consistent, and matches the file's established convention. No blocking issues found. ## 🟡 Suggestions - `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:107` / `:192` — confirmed via grep that `agent-argus-token` (old name) has no other references anywhere else in the repo, so this rename is self-contained; no dangling references to clean up elsewhere (e.g. Hermes kubeconfig tooling, docs). Nothing to change, just noting it was checked. - PR body notes Argus loses cluster access until Hermes rotates `KUBECONFIG_CONTENT` (REN-524) and treats that as accepted/expected — worth double-checking that REN-524 is actually in flight/scheduled before merging this, since otherwise Argus is down with no tracked follow-up. ## Tests No test suite applies to this kind of static RBAC/Secret-name YAML change; the PR description's own verification steps (lint, post-merge check that `agent-argus-token` is absent and `agent-argus-token-v2` is present) are the appropriate verification method here and are reasonable. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

Ghost approved these changes

2026-10-03 15:04:00 +00:00

Ghost left a comment

Approved on 8f98d267c6. Checked: 2-line rename in agent-kubectl-rbac.yaml (Secret name + agent-token-read resourceNames); no other refs to agent-argus-token in repo; SA annotation agent-argus kept; ks paperclip prune: true, Ready at 080ef16b where REN-509 renames pruned old Secrets. Revert = revert commit (mints a new token, not the leaked one).

Approved on 8f98d267c64233c6f6ed72ad7932f6056af20af5. Checked: 2-line rename in agent-kubectl-rbac.yaml (Secret name + agent-token-read resourceNames); no other refs to agent-argus-token in repo; SA annotation agent-argus kept; ks paperclip prune: true, Ready at 080ef16b where REN-509 renames pruned old Secrets. Revert = revert commit (mints a new token, not the leaked one).

Ghost merged commit 2d8191efdd into master

2026-10-03 15:04:00 +00:00

Ghost referenced this issue from a commit

2026-10-03 15:04:02 +00:00

Merge pull request 'paperclip: rotate agent-argus SA token Secret via rename (REN-525)' (#1104) from atlas/ren-525-rotate-argus-token into master

Ghost referenced this pull request

2026-10-03 16:39:39 +00:00

paperclip: rotate agent-hestia SA token Secret via rename to -v3 (REN-540) #1107

Ghost referenced this pull request

2026-10-03 16:48:39 +00:00

fix(paperclip): rotate agent-atlas SA token Secret to -v3 (REN-539) #1109

Ghost referenced this pull request