From f835f40eb7fcbb7d98337222b1cdbb8c4a39c692 Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sat, 3 Oct 2026 16:39:31 +0000 Subject: [PATCH] paperclip: rotate agent-hestia SA token Secret via rename to -v3 (REN-540) The token leaked into Hestia run 13bd8a68 (REN-535). Renaming makes the token controller mint a new token; Flux prunes the old Secret, which invalidates the leaked token. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/paperclip/agent-kubectl-rbac.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml index 5dcef499..d4dfa833 100644 --- a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml +++ b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml @@ -93,7 +93,7 @@ apiVersion: v1 kind: Secret type: kubernetes.io/service-account-token metadata: - name: agent-hestia-token-v2 + name: agent-hestia-token-v3 namespace: paperclip labels: app.kubernetes.io/name: paperclip @@ -188,7 +188,7 @@ rules: resourceNames: - agent-atlas-token-v2 - agent-iris-token - - agent-hestia-token-v2 + - agent-hestia-token-v3 - agent-argus-token-v2 - agent-hermes-token-v2 --- -- 2.54.0