From 4e65f02fbaef76b8ad0a00cc2bbbf0dcbdc87dae Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Wed, 21 Jan 2026 12:18:57 -0300
Subject: [PATCH] monitoring: prepopulate vault for dedupe job

---
 .../monitoring/grafana-user-dedupe-job.yaml   | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/services/monitoring/grafana-user-dedupe-job.yaml b/services/monitoring/grafana-user-dedupe-job.yaml
index 631c25d..3eb001b 100644
--- a/services/monitoring/grafana-user-dedupe-job.yaml
+++ b/services/monitoring/grafana-user-dedupe-job.yaml
@@ -2,20 +2,23 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: grafana-user-dedupe-api-v3
+  name: grafana-user-dedupe-api-v4
   namespace: monitoring
-  annotations:
-    vault.hashicorp.com/agent-inject: "true"
-    vault.hashicorp.com/role: "monitoring"
-    vault.hashicorp.com/agent-inject-secret-grafana-env.sh: "kv/data/atlas/monitoring/grafana-admin"
-    vault.hashicorp.com/agent-inject-template-grafana-env.sh: |
-      {{ with secret "kv/data/atlas/monitoring/grafana-admin" }}
-      export GRAFANA_USER="{{ index .Data.data "admin-user" }}"
-      export GRAFANA_PASSWORD="{{ index .Data.data "admin-password" }}"
-      {{ end }}
 spec:
   backoffLimit: 1
   template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/role: "monitoring"
+        vault.hashicorp.com/agent-inject-secret-grafana-env.sh: "kv/data/atlas/monitoring/grafana-admin"
+        vault.hashicorp.com/agent-inject-template-grafana-env.sh: |
+          {{ with secret "kv/data/atlas/monitoring/grafana-admin" }}
+          export GRAFANA_USER="{{ index .Data.data "admin-user" }}"
+          export GRAFANA_PASSWORD="{{ index .Data.data "admin-password" }}"
+          {{ end }}
     spec:
       serviceAccountName: monitoring-vault-sync
       automountServiceAccountToken: true