From ccb755ba38b5b2b44ad283e11cea117233040163 Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sat, 3 Oct 2026 16:49:21 +0000 Subject: [PATCH] paperclip: rotate agent-argus SA token Secret via rename to -v3 (REN-544) The -v2 token leaked into Argus run d2eede8a (REN-542). Renaming makes the token controller mint a new token; Flux prunes the old Secret, which invalidates the leaked token. Co-Authored-By: Claude Opus 5.5 --- kubernetes/apps/paperclip/agent-kubectl-rbac.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml index 31934cfc..1a1c1027 100644 --- a/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml +++ b/kubernetes/apps/paperclip/agent-kubectl-rbac.yaml @@ -104,7 +104,7 @@ apiVersion: v1 kind: Secret type: kubernetes.io/service-account-token metadata: - name: agent-argus-token-v2 + name: agent-argus-token-v3 namespace: paperclip labels: app.kubernetes.io/name: paperclip @@ -189,7 +189,7 @@ rules: - agent-atlas-token-v3 - agent-iris-token - agent-hestia-token-v3 - - agent-argus-token-v2 + - agent-argus-token-v3 - agent-hermes-token-v2 --- apiVersion: rbac.authorization.k8s.io/v1 -- 2.54.0