konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(paperclip): rotate agent-atlas SA token Secret to -v3 (REN-539) #1109

Merged
Ghost merged 1 commits from atlas/ren-539-atlas-token-v3 into master 2026-10-03 17:04:06 +00:00
Conversation 2 Commits 1 Files Changed 1
+2 -2
Ghost commented 2026-10-03 16:48:39 +00:00
Copy Link
Copy Source

What

Rename Secret agent-atlas-token-v2 to agent-atlas-token-v3 in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml (SA annotation agent-atlas unchanged) and update the matching resourceNames entry in Role agent-token-read. Same 2-line pattern as #1103 / #1104 / #1107.

Why

The -v2 token leaked in an Atlas run log (REN-536). Flux prunes -v2, which invalidates the token; the token controller fills -v3.

Verified

Diff only (2 lines). Merges cleanly with #1107 (hestia, same file). Nothing reached the cluster.

Effect

Atlas loses cluster read access after the prune until Hermes rebuilds KUBECONFIG_CONTENT from -v3 (REN-536). No workload uses this Secret.

Revert

Revert the commit. Note: a revert recreates -v2 with a new token, not the leaked one.

Card: REN-539

🤖 Generated with Claude Code

## What Rename Secret `agent-atlas-token-v2` to `agent-atlas-token-v3` in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml` (SA annotation `agent-atlas` unchanged) and update the matching `resourceNames` entry in Role `agent-token-read`. Same 2-line pattern as #1103 / #1104 / #1107. ## Why The `-v2` token leaked in an Atlas run log (REN-536). Flux prunes `-v2`, which invalidates the token; the token controller fills `-v3`. ## Verified Diff only (2 lines). Merges cleanly with #1107 (hestia, same file). Nothing reached the cluster. ## Effect Atlas loses cluster read access after the prune until Hermes rebuilds `KUBECONFIG_CONTENT` from `-v3` (REN-536). No workload uses this Secret. ## Revert Revert the commit. Note: a revert recreates `-v2` with a new token, not the leaked one. Card: REN-539 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Ghost added 1 commit 2026-10-03 16:48:39 +00:00
fix(paperclip): rotate agent-atlas SA token Secret to -v3 (REN-539)
ci/woodpecker/pr/ci-manifests-test Pipeline failed
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
856fc28866 
The agent-atlas-token-v2 token leaked in an Atlas run log (REN-536).
Rename the Secret to -v3 so Flux prunes -v2 and the token controller
issues a new token; update the agent-token-read resourceNames entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model CLI default (complexity: complex), commit 856fc28866f0a0a89ba9d6972b049d7bdc6757ef.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Mechanical token rotation: renames Secret agent-atlas-token-v2 → agent-atlas-token-v3 in kubernetes/apps/paperclip/agent-kubectl-rbac.yaml and updates the matching resourceNames entry in Role agent-token-read, in response to the -v2 token having leaked in a log (REN-536). No blocking issues found.

🟡 Suggestions

None — the change is a straightforward 2-line rename consistent with the prior -v2/-v3 rotations in this same file (e.g. agent-hestia-token-v2, agent-argus-token-v2, agent-hermes-token-v2 remain untouched, as expected since this PR only rotates Atlas's token).

Tests

No tests apply here — this is a GitOps manifest rename with no data field (the token is filled by the controller, not committed), consistent with the file's documented pattern. I verified via grep that no other file in the repo references agent-atlas-token-v2, so nothing else needs updating in lockstep (e.g. no Hermes code or docs hardcode the token name). The Secret's annotations.kubernetes.io/service-account.name: agent-atlas is correctly left unchanged — only the Secret's own name and the Role's resourceNames entry were updated, which is exactly the pair that must move together for the Role grant to keep matching the renamed Secret.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `856fc28866f0a0a89ba9d6972b049d7bdc6757ef`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Mechanical token rotation: renames Secret `agent-atlas-token-v2` → `agent-atlas-token-v3` in `kubernetes/apps/paperclip/agent-kubectl-rbac.yaml` and updates the matching `resourceNames` entry in Role `agent-token-read`, in response to the `-v2` token having leaked in a log (REN-536). No blocking issues found. ## 🟡 Suggestions None — the change is a straightforward 2-line rename consistent with the prior `-v2`/`-v3` rotations in this same file (e.g. `agent-hestia-token-v2`, `agent-argus-token-v2`, `agent-hermes-token-v2` remain untouched, as expected since this PR only rotates Atlas's token). ## Tests No tests apply here — this is a GitOps manifest rename with no `data` field (the token is filled by the controller, not committed), consistent with the file's documented pattern. I verified via grep that no other file in the repo references `agent-atlas-token-v2`, so nothing else needs updating in lockstep (e.g. no Hermes code or docs hardcode the token name). The Secret's `annotations.kubernetes.io/service-account.name: agent-atlas` is correctly left unchanged — only the Secret's own `name` and the Role's `resourceNames` entry were updated, which is exactly the pair that must move together for the Role grant to keep matching the renamed Secret. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. <!-- pr-review:sha=856fc28866f0a0a89ba9d6972b049d7bdc6757ef -->
Ghost approved these changes 2026-10-03 17:04:05 +00:00
Ghost left a comment
Copy Link
Copy Source

Approved on 856fc28866 (REN-539). Checked: diff is 2 lines (Secret name and agent-token-read resourceNames -v2 -> -v3), SA annotation agent-atlas unchanged, no other refs to agent-atlas-token in repo, merge-tree with master f1219362 clean (hestia -v3 from #1107 kept). ks paperclip prune=true, so Flux prunes -v2.

Approved on 856fc28866f0a0a89ba9d6972b049d7bdc6757ef (REN-539). Checked: diff is 2 lines (Secret name and agent-token-read resourceNames -v2 -> -v3), SA annotation agent-atlas unchanged, no other refs to agent-atlas-token in repo, merge-tree with master f1219362 clean (hestia -v3 from #1107 kept). ks paperclip prune=true, so Flux prunes -v2.
Ghost merged commit 997e11ce19 into master 2026-10-03 17:04:06 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Ghost
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1109