platform-engineer-agent/k3s-cluster
1
0
Fork 0
forked from roger/k3s-cluster
Code Pull Requests Activity

enable api access for agents home manager and platform engineer

Browse Source
This commit is contained in:
Roger Oriol
2026-07-26 14:37:37 +02:00
parent 7af7ae66de
commit 4f6255800b
2 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
home-manager/deployment.yaml
View File

@@ -63,7 +63,8 @@ spec:
DISCORD_BOT_TOKEN DISCORD_HOME_CHANNEL \
GATEWAY_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \
API_SERVER_KEY; do
eval "v=\${$k:-}"
[ -n "$v" ] && echo "$k=$v" >> /opt/data/.env
done
@@ -103,6 +104,14 @@ spec:
# it lives here rather than in the Secret. The SOUL.md uses $HOMEASSISTANT_URL.
- name: HOMEASSISTANT_URL
value: "http://home-assistant.home-assistant:80"
# Expose the Hermes gateway HTTP API on port 8642 (the Service routes
# 80 → 8642). Used by Open WebUI and other in-cluster clients to talk
# to the agent as an OpenAI-compatible endpoint.
- name: API_SERVER_ENABLED
value: "true"
# NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom)
# and is also seeded into /opt/data/.env by the init container. Clients
# (e.g. Open WebUI) authenticate with `Authorization: Bearer <key>`.
# HERMES_WRITE_SAFE_ROOT is intentionally unset → defaults to HERMES_HOME
# (/opt/data). The home agent has no git workspace to write to, so the
# tighter default is correct (memory/skills/scripts live under /opt/data).
@@ -118,7 +127,8 @@ spec:
cpu: "1000m"
livenessProbe:
# Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1
# and binds 0.0.0.0). The gateway API on 8642 is off by default.
# and binds 0.0.0.0). The gateway API on 8642 is enabled via
# API_SERVER_ENABLED=true above.
tcpSocket:
port: 9119
initialDelaySeconds: 90

14
platform-engineer/deployment.yaml
View File

@@ -89,7 +89,8 @@ spec:
DISCORD_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
GITEA_TOKEN GITEA_REPO_URL ARGOCD_API_TOKEN ARGOCD_SERVER \
HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do
HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET \
API_SERVER_KEY; do
eval "v=\${$k:-}"
[ -n "$v" ] && echo "$k=$v" >> /opt/data/.env
done
@@ -132,6 +133,14 @@ spec:
# with yolo:true, approvals.mode:off, and the agent having no k8s RBAC.
- name: HERMES_WRITE_SAFE_ROOT
value: "/"
# Expose the Hermes gateway HTTP API on port 8642 (the Service routes
# 80 → 8642). Used by Open WebUI and other in-cluster clients to talk
# to the agent as an OpenAI-compatible endpoint.
- name: API_SERVER_ENABLED
value: "true"
# NOTE: API_SERVER_KEY comes from the hermes-env Secret (via envFrom)
# and is also seeded into /opt/data/.env by the init container. Clients
# (e.g. Open WebUI) authenticate with `Authorization: Bearer <key>`.
volumeMounts:
- name: data
mountPath: /opt/data
@@ -146,7 +155,8 @@ spec:
cpu: "1000m"
livenessProbe:
# Probe the dashboard port (9119, always enabled via HERMES_DASHBOARD=1
# and binds 0.0.0.0). The gateway API on 8642 is off by default.
# and binds 0.0.0.0). The gateway API on 8642 is enabled via
# API_SERVER_ENABLED=true above.
tcpSocket:
port: 9119
initialDelaySeconds: 90