From 0a7410302d719edf612f7b0db033901ada29569d Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 1 Jan 2026 18:12:21 -0300
Subject: [PATCH] comms(mas): fix admin secret job permissions

---
 .../communication/mas-admin-client-secret-ensure-job.yaml  | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/services/communication/mas-admin-client-secret-ensure-job.yaml b/services/communication/mas-admin-client-secret-ensure-job.yaml
index da37915..210e729 100644
--- a/services/communication/mas-admin-client-secret-ensure-job.yaml
+++ b/services/communication/mas-admin-client-secret-ensure-job.yaml
@@ -33,14 +33,14 @@ subjects:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-admin-client-secret-ensure-5
+  name: mas-admin-client-secret-ensure-6
   namespace: comms
 spec:
-  backoffLimit: 0
+  backoffLimit: 2
   template:
     spec:
       serviceAccountName: mas-admin-client-secret-writer
-      restartPolicy: Never
+      restartPolicy: OnFailure
       volumes:
         - name: work
           emptyDir: {}
@@ -53,6 +53,7 @@ spec:
               set -euo pipefail
               umask 077
               dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n' > /work/client_secret
+              chmod 0644 /work/client_secret
           volumeMounts:
             - name: work
               mountPath: /work