bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(hermes): run the Vault agent before the pod's own init containers
Some checks failed
Tests / Declarative: Post Actions testing.tests.test_repo_structure.test_knowledge_service_mirror_matches_source failed
Details

Browse Source 
The agent init container is appended by default, so init-config ran before
/vault/secrets existed and fell back to the Secret every time. The values were
identical, so the migration appeared to work while Vault was never actually
read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
jenkins 2026-08-06 12:20:53 -03:00
parent 83f8d67640
commit 5286723b58
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
services/hermes/deployment.yaml
View File

@ -37,6 +37,11 @@ spec:
{{ .Data.data.anthropic_oauth_token }}
{{- end }}
vault.hashicorp.com/agent-pre-populate-only: "true"
# Without this the agent init container is appended after the
# pod's own init containers, so init-config runs before the
# secret file exists and silently falls back to the Secret -
# the migration looks complete while Vault is never read.
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-requests-cpu: 25m
vault.hashicorp.com/agent-requests-mem: 32Mi
vault.hashicorp.com/agent-limits-cpu: 100m