bceb686322
The bot-seeder Deployment runs a shell script at startup that: - Checks GET /api/bots and skips any bot already registered (idempotent) - Waits for each bot's /health endpoint before registering - POSTs to /api/register with name, owner=system, and cluster-internal endpoint_url - Captures the returned shared_secret and upserts acb-bot-<name>-secret via the K8s REST API - Sleeps forever after all 6 bots are registered Also adds reloader.stakater.com/auto: "true" to all 6 bot Deployments so Reloader triggers a rolling restart when the seeder writes/updates their secrets, ensuring pods pick up the correct BOT_SECRET for HMAC validation. RBAC: bot-seeder ServiceAccount + Role (get/create/patch secrets) + RoleBinding. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
# bot-seeder-rbac.yml: RBAC for the bot registration seeder
|
|
# ServiceAccount + Role allowing get/create/patch Secrets in the acb-bots namespace.
|
|
# The seeder uses the K8s REST API (via curl + the mounted ServiceAccount token)
|
|
# to upsert acb-bot-<name>-secret with the shared_secret returned by POST /api/register.
|
|
#
|
|
# Staging file — sync to declarative-config/k8s/iad-acb/acb-bots/
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: bot-seeder
|
|
namespace: acb-bots
|
|
labels:
|
|
app.kubernetes.io/name: bot-seeder
|
|
app.kubernetes.io/part-of: ai-code-battle
|
|
app.kubernetes.io/component: seeder
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: bot-seeder
|
|
namespace: acb-bots
|
|
labels:
|
|
app.kubernetes.io/name: bot-seeder
|
|
app.kubernetes.io/part-of: ai-code-battle
|
|
app.kubernetes.io/component: seeder
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: bot-seeder
|
|
namespace: acb-bots
|
|
labels:
|
|
app.kubernetes.io/name: bot-seeder
|
|
app.kubernetes.io/part-of: ai-code-battle
|
|
app.kubernetes.io/component: seeder
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: bot-seeder
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: bot-seeder
|
|
namespace: acb-bots
|