From 43c0c2561eb5e6b28d05b545cee0d12a10bb80b2 Mon Sep 17 00:00:00 2001
From: Roger Oriol <rogi23696@gmail.com>
Date: Sat, 18 Jul 2026 19:29:52 +0200
Subject: [PATCH] fix hermes write folder

---
 platform-engineer/deployment.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/platform-engineer/deployment.yaml b/platform-engineer/deployment.yaml
index eff1fae..2221040 100644
--- a/platform-engineer/deployment.yaml
+++ b/platform-engineer/deployment.yaml
@@ -125,6 +125,13 @@ spec:
         env:
         - name: HERMES_HOME
           value: /opt/data
+        # Hermes' file-write tool refuses any path outside HERMES_WRITE_SAFE_ROOT.
+        # When unset it defaults to HERMES_HOME (/opt/data), which blocks the
+        # agent's only GitOps remediation path (editing manifests under
+        # /workspace/k3s-cluster). Whitelist the whole filesystem — consistent
+        # with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
+        - name: HERMES_WRITE_SAFE_ROOT
+          value: "/"
         volumeMounts:
         - name: data
           mountPath: /opt/data