jakman85andClaude Opus 5
a7eadd4054
The registry had two blockers. #59 fixed the first (nodes resolved the hostname to the non-hairpinned WAN and failed TLS against the router's CN=%D cert). This is the second: the pull is unauthenticated, and this registry refuses unauthenticated clients outright — measured 2026-10-05, its anonymous token carries access: null and every path 401s. pm-agent-registry is a dockerconfigjson Secret (SOPS, placeholders) referenced by imagePullSecrets on the dispatcher Deployment and on the committed worker Job template. It holds the SAME Gitea token as pm-agent-credentials, because the two consumers need two formats: the application reads a raw token from env, the kubelet reads a dockerconfigjson before any container starts. Same one-value-in-two-files pattern as the Keycloak client secret, documented in both .example files. The operator's part is the value plus one new scope: read:package. ADMISSION GAINED A SEVENTH RULE. imagePullSecrets is a pod-spec field no container references, which is exactly why it is easy to leave unread — the same shape of omission as initContainers, ephemeralContainers, env and envFrom before it. The kubelet reads the named Secret, in this namespace, before anything runs. Rule 1's pattern now REQUIRES the committed entry; rule 7 forbids any other and any second one. Both halves are needed: a foreach over an absent list yields no result. The leverage is small and the policy says so: the image is digest-pinned, so a different pull credential cannot change WHAT runs. Pinned anyway — 'only the committed shape' is the premise, and the rule costs four lines. kyverno test: 33 passed, 0 failed (was 28). Three new fixtures, each a real path: the committed entry plus a second one, a different Secret, and none at all. The gate also caught me shipping the Secret in plaintext — I never ran sops -e -i on the placeholder. Recorded in the handoff entry, because the file looked finished. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
48 lines
2.8 KiB
YAML
48 lines
2.8 KiB
YAML
---
|
|
# pm-agent — the Program Manager agent service. Reconciled by its OWN post-platform Flux
|
|
# Kustomization (clusters/base/pm-agent.yaml, dependsOn apps-wave-0, wait:false), NOT by the
|
|
# gating `platform` tier.
|
|
#
|
|
# WHY ITS OWN NON-GATING TIER, like crafty/headlamp/homepage: this is a leaf whose pod can be
|
|
# legitimately unhealthy for a long time — it CrashLoops by design while its credentials are
|
|
# still placeholders, and it depends on Gitea being up (apps-wave-0) to authenticate at
|
|
# startup. A workload like that inside the gating `platform` tier would keep `platform`
|
|
# not-Ready, and while `platform` is not-Ready NOTHING downstream reconciles. That is the
|
|
# headlamp gating stall, and it is not worth re-learning.
|
|
#
|
|
# dependsOn apps-wave-0 rather than platform-config: what this service actually needs is
|
|
# GITEA, not the Keycloak realm, the wildcard certificate or the Gateway — it serves no
|
|
# traffic and has no UI.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
# The dispatcher identity (may create worker Jobs here) and the worker identity (bound to
|
|
# nothing). Read alongside platform/kyverno/admission/pm-agent-job-shape.yaml: that policy
|
|
# is the boundary, this file is only its necessary half.
|
|
- rbac.yaml
|
|
- configmap.yaml
|
|
# The Gitea token and the Anthropic subscription token — SOPS-encrypted, decrypted
|
|
# per-environment by the pm-agent Kustomization (clusters/prod and clusters/dev patch it by
|
|
# name, identically to crafty/headlamp/oauth2-proxy). Referenced by name only (R-IDP-04).
|
|
#
|
|
# THE COMMITTED VALUES ARE PLACEHOLDERS. The service is inert until the operator replaces
|
|
# them; the hand-off steps are in the sibling `.example` template and in README.md.
|
|
#
|
|
# That template is named in prose rather than by filename ON PURPOSE: the L0 check
|
|
# no-plaintext-secrets treats a mention of an unencrypted `.example` in a kustomization as
|
|
# a REFERENCE and refuses it as a plaintext Secret that would be applied. It is right to —
|
|
# the distance between naming a file in a comment and listing it under `resources:` is one
|
|
# careless edit.
|
|
- pm-agent-credentials.sops.yaml
|
|
# The KUBELET's pull credential for agent-runner — a separate Secret from the one above
|
|
# because it is a different consumer in a different format: dockerconfigjson, read before
|
|
# any container starts. Same underlying Gitea token, which must also carry `read:package`.
|
|
# Measured 2026-10-05: this registry refuses unauthenticated clients outright, so without
|
|
# this the pull 401s. Also placeholders until the operator fills it in.
|
|
- pm-agent-registry.sops.yaml
|
|
- deployment.yaml
|
|
# default-deny baseline + the two egress allow policies (gitea, kube-apiserver for the
|
|
# dispatcher only, tcp/443 for the model). NO ingress allow exists, by design.
|
|
- networkpolicy.yaml
|