claude-bot
dd954ce23a
Hermes Agent as a pod in its own `hermes` namespace: gateway (messaging platforms, cron, OpenAI-compatible API) and dashboard, supervised by the image's s6-overlay, state on a 10Gi ceph-block PVC. - hermes.renner.uno (LAN): dashboard and Hermes Desktop remote gateway. Plain Traefik plus the dashboard's own Authentik OIDC login (public PKCE client, Hermes Users group) — a forward-auth gate would break Desktop's Bearer-token calls. - hermes-api.renner.uno (LAN): API server, Bearer key generated in-cluster by an ESO Password generator. - Read-only kubectl via the built-in `view` ClusterRole. - CNPs: world 443/80, kube-apiserver, Traefik for LAN hostnames, and Prometheus/Alertmanager/Loki (with the matching monitoring-side grant). - Image automation for nousresearch/hermes-agent v-tags. After deploy: log in to Anthropic inside the pod (`hermes auth add anthropic --type oauth --no-browser`, then `hermes model`); platform and Home Assistant tokens go in via the dashboard. Not yet covered: a Velero schedule for the PVC.
23 lines
574 B
YAML
23 lines
574 B
YAML
# Read-only cluster access for the agent's kubectl, as for claude-workstation:
|
|
# the built-in `view` ClusterRole, which excludes Secrets. The token is the
|
|
# pod's projected ServiceAccount token; kubectl picks it up as in-cluster
|
|
# config.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: hermes
|
|
namespace: hermes
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: hermes-view
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: view
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: hermes
|
|
namespace: hermes
|