Bitwarden Secrets Manager

필수 Secret	오버레이
BWS_ACCESS_TOKEN	values-bitwarden.yaml

언제 사용하나요?

읽기 권한이 있는 Bitwarden machine account와 bootstrap Kubernetes Secret이 필요합니다.

설치

helm upgrade --install hermes-agent ./charts/hermes-agent \
  --namespace hermes-agent --create-namespace \
  -f charts/hermes-agent/values-bitwarden.yaml \
  --set-string env.BWS_ACCESS_TOKEN='<real-value>' --wait

둘 이상의 자격 증명이 필요한 예제에서는 모든 값을 --set-string으로 전달하거나 extraEnvFrom으로 기존 Secret을 참조하세요.

배포 전 조정

provider key는 Git이나 Kubernetes Secret이 아닌 Bitwarden project에 보관합니다.

원본 YAML 열기

전체 오버레이

charts/hermes-agent/values-bitwarden.yaml

# values-bitwarden.yaml
#
# Hermes Agent with Bitwarden Secrets Manager as the source of provider keys.
# The Kubernetes Secret contains only the Bitwarden machine-account token;
# provider keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, Discord bot tokens, etc.)
# stay in the selected Bitwarden project and Hermes fetches them at startup.
#
# 1. Create a Bitwarden Secrets Manager machine account with read access to a
#    project whose secret names are the environment variables Hermes expects.
# 2. Create the bootstrap-token Secret (do not commit the token):
#      kubectl create secret generic bitwarden-bootstrap \
#        --namespace hermes-agent \
#        --from-literal=BWS_ACCESS_TOKEN='0.<machine-account-token>'
# 3. Install this overlay:
#      helm upgrade --install hermes-agent ./charts/hermes-agent \
#        --namespace hermes-agent --create-namespace \
#        -f charts/hermes-agent/values-bitwarden.yaml --wait
#
# On first startup Hermes downloads its checksum-verified `bws` CLI into the
# persistent HERMES_HOME volume. The pod therefore needs egress to Bitwarden
# and GitHub Releases; subsequent starts reuse the binary.

config:
  model:
    provider: openai-api
    default: gpt-4o-mini
  secrets:
    bitwarden:
      enabled: true
      # Bitwarden Secrets Manager project UUID containing provider keys.
      project_id: "REPLACE_ME_BITWARDEN_PROJECT_UUID"
      # Optional endpoint override (upstream default: US Cloud).
      # server_url: "https://vault.bitwarden.com"
      cache_ttl_seconds: 300
      # Bitwarden is the source of truth for the provider keys it supplies.
      override_existing: true
  terminal:
    backend: local

env:
  # Bitwarden replaces this chart placeholder with OPENAI_API_KEY from its
  # project. Keep it only to override the chart's default OpenAI placeholder.
  OPENAI_API_KEY: "unused"

# The bootstrap token is an externally managed Kubernetes Secret, not a Helm
# value. Hermes protects BWS_ACCESS_TOKEN from replacement by Bitwarden.
extraEnvFrom:
  - secretRef:
      name: bitwarden-bootstrap