vault: prepopulate injector for jobs

services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "bstein-dev-home"
         vault.hashicorp.com/agent-inject-secret-portal-env.sh: "kv/data/atlas/portal/atlas-portal-db"
         vault.hashicorp.com/agent-inject-template-portal-env.sh: |

services/bstein-dev-home/vaultwarden-cred-sync-cronjob.yaml

@@ -16,6 +16,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "bstein-dev-home"
             vault.hashicorp.com/agent-inject-secret-portal-env.sh: "kv/data/atlas/portal/atlas-portal-db"
             vault.hashicorp.com/agent-inject-template-portal-env.sh: |

services/comms/bstein-force-leave-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "comms"
         vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime"
         vault.hashicorp.com/agent-inject-template-mas-admin-secret: |

services/comms/guest-name-job.yaml

@@ -17,6 +17,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "comms"
             vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
             vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/mas-local-users-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "comms"
         vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
         vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/othrys-kick-numeric-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "comms"
         vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
         vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/pin-othrys-job.yaml

@@ -17,6 +17,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "comms"
             vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
             vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/reset-othrys-room-job.yaml

@@ -17,6 +17,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "comms"
             vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
             vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/seed-othrys-room.yaml

@@ -15,6 +15,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "comms"
             vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
             vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/synapse-seeder-admin-ensure-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "comms"
         vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
         vault.hashicorp.com/agent-inject-template-turn-secret: |

services/comms/synapse-user-seed-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "comms"
         vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
         vault.hashicorp.com/agent-inject-template-turn-secret: |

services/keycloak/endurain-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/keycloak/harbor-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/keycloak/ldap-federation-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/logs-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/keycloak/mas-secrets-ensure-job.yaml

@@ -19,6 +19,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/agent-init-first: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"

services/keycloak/portal-e2e-client-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/portal-e2e-execute-actions-email-test-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/portal-e2e-target-client-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/portal-e2e-token-exchange-permissions-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/portal-e2e-token-exchange-test-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/realm-settings-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/sparkyfitness-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/keycloak/synapse-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/keycloak/user-overrides-job.yaml

@@ -10,6 +10,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso"
         vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |

services/keycloak/vault-oidc-secret-ensure-job.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "sso-secrets"
         vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
         vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |

services/mailu/mailu-sync-cronjob.yaml

@@ -13,6 +13,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "mailu-mailserver"
             vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
             vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |

services/mailu/mailu-sync-job.yaml

@@ -9,6 +9,7 @@ spec:
     metadata:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: "mailu-mailserver"
         vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
         vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |

services/nextcloud-mail-sync/cronjob.yaml

@@ -15,6 +15,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "nextcloud"
             vault.hashicorp.com/agent-inject-secret-nextcloud-env.sh: "kv/data/atlas/nextcloud/nextcloud-db"
             vault.hashicorp.com/agent-inject-template-nextcloud-env.sh: |

services/nextcloud/maintenance-cronjob.yaml

@@ -13,6 +13,7 @@ spec:
         metadata:
           annotations:
             vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
             vault.hashicorp.com/role: "nextcloud"
             vault.hashicorp.com/agent-inject-secret-nextcloud-env.sh: "kv/data/atlas/nextcloud/nextcloud-db"
             vault.hashicorp.com/agent-inject-template-nextcloud-env.sh: |