paperclip: rotate agent-argus SA token Secret via rename to -v3 (REN-544) #1110
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: konairius/homelab#1110
Reference in New Issue
Block a user
What
Rename Secret
paperclip/agent-argus-token-v2→agent-argus-token-v3(typekubernetes.io/service-account-token, annotationkubernetes.io/service-account.name: agent-argusunchanged) and the matchingresourceNamesentry in Roleagent-token-read.Why
The
-v2token was printed in Argus rund2eede8a(REN-542). The token controller mints a new token for-v3; Flux prunes-v2, which invalidates the leaked token. Same change as REN-525 (#1104).How verified
Diff is exactly two lines; no other reference to
agent-argus-tokenin the repo. No kubectl/kustomize in the runner, so not rendered locally. Cluster check after merge:flux reconcile ks paperclip,-v2gone,-v3hasdata.token.Impact
Argus loses cluster access from merge until Hermes rotates its KUBECONFIG_CONTENT (REN-542). Accepted: the old token is leaked. No workload restarts.
Note: #1107 (hestia) and #1109 (atlas) edit neighbouring lines in the same Role; whichever merges later may need a rebase.
Revert
Revert this commit. Note a revert recreates
-v2with a new token, not the leaked one.🤖 Generated with Claude Code
🤖 Automated review — model
CLI default(complexity: complex), commit512ac2e41bbe22e4e7bfd43db08668d7972c3af6.Summary
This PR renames the
agent-argusServiceAccount token Secret fromagent-argus-token-v2toagent-argus-token-v3and updates the matchingresourceNamesentry in theagent-token-readRole (kubernetes/apps/paperclip/agent-kubectl-rbac.yaml:107and:192), to force Kubernetes to mint a fresh token after the old one was leaked in a bot run (REN-542). This is a minimal, mechanical two-line change that mirrors the prior REN-525 (#1104) rotation pattern already present in this same file (e.g.agent-atlas-token-v2,agent-hestia-token-v2). No blocking issues found.🟡 Suggestions
resourceNameslist (agent-kubectl-rbac.yaml:188-193), so whichever of these merges last will need a rebase. Not a defect in this PR, but worth confirming before merge that it's still rebased against currentmasterif the others landed first.KUBECONFIG_CONTENT(REN-542) — this is called out as accepted/expected, not a code issue, but worth the human merging to double check that follow-up is tracked/actioned.Tests
No automated tests apply to this repo's structure for this change (static manifest rename). The PR author verified by inspection that the diff is exactly two lines and that there are no other references to
agent-argus-tokenin the repo — I independently confirmed this via grep across the repository: the only file referencingagent-argus-token-*iskubernetes/apps/paperclip/agent-kubectl-rbac.yaml, and the Secret'sannotations.kubernetes.io/service-account.name: agent-argusis unchanged, so the renamed Secret still binds to the correct ServiceAccount. The stated cluster-side verification plan (flux reconcile ks paperclip, confirm-v2gone and-v3hasdata.token) is reasonable for this change and must happen post-merge since it can't be rendered/tested locally (no kubectl/kustomize in this runner).Recommendation
Looks reasonable — no blocking issues; comments above are optional.
Changes requested on
512ac2e4: content correct (Secret name + Role resourceNames only, no other agent-argus-token refs), but conflicts with master after #1107/#1109 (Role now lists atlas-v3/hestia-v3). Rebase on origin/master keeping those, force-push; I re-review the new SHA.512ac2e41btoccb755ba38Approve @
ccb755ba38. Diff vs master997e11ceis 2 lines: Secret agent-argus-token-v2->v3 (type and service-account.name annotation unchanged) and Role agent-token-read resourceNames. master's atlas/hestia -v3 entries kept. git merge-tree clean, no conflict markers, agent-argus-token only in those 2 places. Flux ks paperclip has prune: true, so -v2 is deleted on reconcile. Revert = revert merge (recreates -v2 with a fresh token).