paperclip: rotate agent-hestia SA token Secret via rename to -v3 (REN-540) #1107

2026-10-03T16:39:39Z

Ghost commented

2026-10-03 16:39:39 +00:00

What: rename Secret paperclip/agent-hestia-token-v2 to agent-hestia-token-v3 (type kubernetes.io/service-account-token, SA agent-hestia, unchanged) and update the matching agent-token-read Role resourceNames entry. This is the same change as #1104 (REN-525).

Why: the -v2 token was printed in Hestia run 13bd8a68 (REN-535) and is burned. The token controller mints a new token for -v3. Flux prunes -v2, which invalidates the leaked token.

Impact: Hestia has no cluster access between the prune and Hermes rebuilding its KUBECONFIG_CONTENT from -v3 (REN-538). This was accepted on the card. No workload or traffic is touched.

Verified: the diff renames only these 2 strings in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml. Linted by diff only. The cluster check comes after merge.

Revert: revert this commit. That recreates -v2 with a new token, so the leaked token stays invalid.

🤖 Generated with Claude Code

**What:** rename Secret `paperclip/agent-hestia-token-v2` to `agent-hestia-token-v3` (type `kubernetes.io/service-account-token`, SA `agent-hestia`, unchanged) and update the matching `agent-token-read` Role resourceNames entry. This is the same change as #1104 (REN-525). **Why:** the -v2 token was printed in Hestia run 13bd8a68 (REN-535) and is burned. The token controller mints a new token for -v3. Flux prunes -v2, which invalidates the leaked token. **Impact:** Hestia has no cluster access between the prune and Hermes rebuilding its KUBECONFIG_CONTENT from -v3 (REN-538). This was accepted on the card. No workload or traffic is touched. **Verified:** the diff renames only these 2 strings in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml`. Linted by diff only. The cluster check comes after merge. **Revert:** revert this commit. That recreates -v2 with a new token, so the leaked token stays invalid. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-10-03 16:39:40 +00:00

paperclip: rotate agent-hestia SA token Secret via rename to -v3 (REN-540)

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline failed

Details

f835f40eb7

The token leaked into Hestia run 13bd8a68 (REN-535). Renaming makes the
token controller mint a new token; Flux prunes the old Secret, which
invalidates the leaked token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot reviewed

2026-10-03 16:44:24 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: unknown), commit f835f40eb7fcbb7d98337222b1cdbb8c4a39c692.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Rotates the leaked agent-hestia service-account token by renaming the Secret agent-hestia-token-v2 → agent-hestia-token-v3 and updating the matching resourceNames entry in the agent-token-read Role, in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml. This is a mechanical, 2-line rename following the same pattern as the prior #1104/REN-525 rotation. No blocking issues found.

🟡 Suggestions

None beyond what's already acknowledged in the PR body. The described gap (Hestia loses cluster access between Flux pruning -v2 and Hermes rebuilding KUBECONFIG_CONTENT from -v3) is an accepted, known consequence of this pattern, not a defect in the diff.

🟢 Nits

None.

Tests

No automated tests apply to this GitOps YAML rename; correctness was verified by inspection:

kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:96 — Secret renamed to agent-hestia-token-v3, with type, namespace, labels, and the kubernetes.io/service-account.name: agent-hestia annotation all left unchanged, so the new Secret still binds to the same (unmodified) ServiceAccount.
kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:191 — the corresponding resourceNames entry in Role agent-token-read updated to match, so Hermes's get grant still resolves to a real Secret name.
A repo-wide search for agent-hestia-token confirms these are the only two references — no other manifest, kustomization, or script in the tree still points at -v2, so the rename is self-contained as claimed.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: unknown), commit `f835f40eb7fcbb7d98337222b1cdbb8c4a39c692`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Rotates the leaked `agent-hestia` service-account token by renaming the Secret `agent-hestia-token-v2` → `agent-hestia-token-v3` and updating the matching `resourceNames` entry in the `agent-token-read` Role, in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml`. This is a mechanical, 2-line rename following the same pattern as the prior #1104/REN-525 rotation. No blocking issues found. ## 🟡 Suggestions - None beyond what's already acknowledged in the PR body. The described gap (Hestia loses cluster access between Flux pruning `-v2` and Hermes rebuilding `KUBECONFIG_CONTENT` from `-v3`) is an accepted, known consequence of this pattern, not a defect in the diff. ## 🟢 Nits None. ## Tests No automated tests apply to this GitOps YAML rename; correctness was verified by inspection: - `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:96` — Secret renamed to `agent-hestia-token-v3`, with `type`, namespace, labels, and the `kubernetes.io/service-account.name: agent-hestia` annotation all left unchanged, so the new Secret still binds to the same (unmodified) ServiceAccount. - `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:191` — the corresponding `resourceNames` entry in Role `agent-token-read` updated to match, so Hermes's `get` grant still resolves to a real Secret name. - A repo-wide search for `agent-hestia-token` confirms these are the only two references — no other manifest, kustomization, or script in the tree still points at `-v2`, so the rename is self-contained as claimed. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

Ghost referenced this pull request

2026-10-03 16:48:39 +00:00

fix(paperclip): rotate agent-atlas SA token Secret to -v3 (REN-539) #1109

Ghost referenced this pull request

2026-10-03 16:49:29 +00:00

paperclip: rotate agent-argus SA token Secret via rename to -v3 (REN-544) #1110

Ghost approved these changes

2026-10-03 16:59:21 +00:00

Ghost left a comment

Approved on f835f40eb7. Diff: 2 strings in agent-kubectl-rbac.yaml (Secret name + agent-token-read resourceNames), no other refs to hestia-token in repo. Flux ks paperclip prune=true, Ready at e553c37c (merge base). Revert: revert commit.

Approved on f835f40eb7fcbb7d98337222b1cdbb8c4a39c692. Diff: 2 strings in agent-kubectl-rbac.yaml (Secret name + agent-token-read resourceNames), no other refs to hestia-token in repo. Flux ks paperclip prune=true, Ready at e553c37c (merge base). Revert: revert commit.

Ghost merged commit d6ce8bdf1f into master

2026-10-03 16:59:22 +00:00

Ghost referenced this issue from a commit

2026-10-03 16:59:23 +00:00

Merge pull request 'paperclip: rotate agent-hestia SA token Secret via rename to -v3 (REN-540)' (#1107) from atlas/ren-540-hestia-token-v3 into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1107