- Shipped
- September 23, 2026 at 1:12 PM UTC
- Author
- Kamo
- Commit
- 216f6bb
Second half of 926986d. Every client now presents the kamo_svc login: the Java services through the shared library's NatsConfig (NATS_USERNAME / NATS_PASSWORD from ***, picked up by a rolling restart), RAGService cd6a7e3 and KBService b08c5ba (their own NatsConfig), ocrservice 26d3b75, kamo-internal 72c8d751, the four universe services, the stream-bootstrap Job. /connz?auth=1 showed 54 of 54 connections authorized as kamo_svc before this was applied, and still 54 of 54 after the reload. So the anon user and the no_auth_user mapping are deleted. Verified from the desktop namespace: CONNECT {} now answers -ERR 'Authorization Violation' (it answered +OK / PONG this morning). SECRETS.md lists the consumers of each Secret; the worldgen agent on k3m1 (universe-earthdata 197df25) reads the same login from a root-only env file on that host. Applied by hand before this commit (ConfigMap + reload); the deploy step's reload makes it a no-op.