aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

HOMELAB-477: feat(helm): add token-refresh CronJob to lab-director chart #103

Merged
claude-agent merged 1 commit from plane/HOMELAB-477-token-refresh into live 2026-03-30 12:53:49 +00:00
Conversation 0 Commits 1 Files changed 3 +105
claude-agent commented 2026-03-30 12:52:55 +00:00
Owner
Copy link

Summary

  • Add Helm CronJob template for automated Claude OAuth token refresh
  • Add RBAC (ServiceAccount, Role, RoleBinding) for cross-namespace secret access
  • Add tokenRefresh values section (disabled by default)

Changes

  • core/charts/apps/lab-director/templates/token-refresh-cronjob.yaml — CronJob with hardened security context
  • core/charts/apps/lab-director/templates/token-refresh-rbac.yaml — SA + Role in secrets ns + RoleBinding
  • core/charts/apps/lab-director/values.yaml — tokenRefresh config section

Test plan

  • helm template renders correctly when enabled
  • Zero output when disabled (default)
  • ArgoCD syncs after merge

Ticket: HOMELAB-477

## Summary - Add Helm CronJob template for automated Claude OAuth token refresh - Add RBAC (ServiceAccount, Role, RoleBinding) for cross-namespace secret access - Add `tokenRefresh` values section (disabled by default) ## Changes - `core/charts/apps/lab-director/templates/token-refresh-cronjob.yaml` — CronJob with hardened security context - `core/charts/apps/lab-director/templates/token-refresh-rbac.yaml` — SA + Role in `secrets` ns + RoleBinding - `core/charts/apps/lab-director/values.yaml` — `tokenRefresh` config section ## Test plan - [x] `helm template` renders correctly when enabled - [x] Zero output when disabled (default) - [ ] ArgoCD syncs after merge Ticket: HOMELAB-477
HOMELAB-477: feat(helm): add token-refresh CronJob templates to lab-director chart
Some checks failed
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
1469f72c78 
Add Helm templates for the Claude OAuth token-refresh CronJob:
- CronJob template with hardened security context (non-root, read-only fs, drop all caps)
- Cross-namespace RBAC (ServiceAccount, Role in secrets ns, RoleBinding)
- tokenRefresh values section (disabled by default, enabled via prod overrides)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!103
No description provided.