From 5286723b58c003fb3fedf91650eb22ebbe93e9ee Mon Sep 17 00:00:00 2001 From: jenkins Date: Thu, 6 Aug 2026 12:20:53 -0300 Subject: [PATCH] fix(hermes): run the Vault agent before the pod's own init containers The agent init container is appended by default, so init-config ran before /vault/secrets existed and fell back to the Secret every time. The values were identical, so the migration appeared to work while Vault was never actually read. Co-Authored-By: Claude Opus 5 --- services/hermes/deployment.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml index 3fe15c1a0..a0751a5a1 100644 --- a/services/hermes/deployment.yaml +++ b/services/hermes/deployment.yaml @@ -37,6 +37,11 @@ spec: {{ .Data.data.anthropic_oauth_token }} {{- end }} vault.hashicorp.com/agent-pre-populate-only: "true" + # Without this the agent init container is appended after the + # pod's own init containers, so init-config runs before the + # secret file exists and silently falls back to the Secret - + # the migration looks complete while Vault is never read. + vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-requests-cpu: 25m vault.hashicorp.com/agent-requests-mem: 32Mi vault.hashicorp.com/agent-limits-cpu: 100m