vault: prepopulate injector for jobs

2026-01-14 14:29:29 -03:00 · 2026-01-14 14:29:29 -03:00 · 98d67293bc
commit 98d67293bc
parent f6fc250fe1
30 changed files with 60 additions and 30 deletions
--- a/services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml
+++ b/services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "bstein-dev-home"
        vault.hashicorp.com/agent-inject-secret-portal-env.sh: "kv/data/atlas/portal/atlas-portal-db"
        vault.hashicorp.com/agent-inject-template-portal-env.sh: |
--- a/services/bstein-dev-home/vaultwarden-cred-sync-cronjob.yaml
+++ b/services/bstein-dev-home/vaultwarden-cred-sync-cronjob.yaml
@ -16,6 +16,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "bstein-dev-home"
            vault.hashicorp.com/agent-inject-secret-portal-env.sh: "kv/data/atlas/portal/atlas-portal-db"
            vault.hashicorp.com/agent-inject-template-portal-env.sh: |
--- a/services/comms/bstein-force-leave-job.yaml
+++ b/services/comms/bstein-force-leave-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime"
        vault.hashicorp.com/agent-inject-template-mas-admin-secret: |
--- a/services/comms/guest-name-job.yaml
+++ b/services/comms/guest-name-job.yaml
@ -17,6 +17,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "comms"
            vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
            vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/mas-local-users-ensure-job.yaml
+++ b/services/comms/mas-local-users-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
        vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/othrys-kick-numeric-job.yaml
+++ b/services/comms/othrys-kick-numeric-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
        vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/pin-othrys-job.yaml
+++ b/services/comms/pin-othrys-job.yaml
@ -17,6 +17,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "comms"
            vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
            vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/reset-othrys-room-job.yaml
+++ b/services/comms/reset-othrys-room-job.yaml
@ -17,6 +17,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "comms"
            vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
            vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/seed-othrys-room.yaml
+++ b/services/comms/seed-othrys-room.yaml
@ -15,6 +15,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "comms"
            vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
            vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/synapse-seeder-admin-ensure-job.yaml
+++ b/services/comms/synapse-seeder-admin-ensure-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
        vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/comms/synapse-user-seed-job.yaml
+++ b/services/comms/synapse-user-seed-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
        vault.hashicorp.com/agent-inject-template-turn-secret: |
--- a/services/keycloak/endurain-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/endurain-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/keycloak/harbor-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/harbor-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/keycloak/ldap-federation-job.yaml
+++ b/services/keycloak/ldap-federation-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/logs-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/logs-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/keycloak/mas-secrets-ensure-job.yaml
+++ b/services/keycloak/mas-secrets-ensure-job.yaml
@ -19,6 +19,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
--- a/services/keycloak/portal-e2e-client-job.yaml
+++ b/services/keycloak/portal-e2e-client-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/portal-e2e-execute-actions-email-test-job.yaml
+++ b/services/keycloak/portal-e2e-execute-actions-email-test-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/portal-e2e-target-client-job.yaml
+++ b/services/keycloak/portal-e2e-target-client-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/portal-e2e-token-exchange-permissions-job.yaml
+++ b/services/keycloak/portal-e2e-token-exchange-permissions-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/portal-e2e-token-exchange-test-job.yaml
+++ b/services/keycloak/portal-e2e-token-exchange-test-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/realm-settings-job.yaml
+++ b/services/keycloak/realm-settings-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/sparkyfitness-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/sparkyfitness-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/keycloak/synapse-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/synapse-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/keycloak/user-overrides-job.yaml
+++ b/services/keycloak/user-overrides-job.yaml
@ -10,6 +10,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso"
        vault.hashicorp.com/agent-inject-secret-keycloak-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-env.sh: |
--- a/services/keycloak/vault-oidc-secret-ensure-job.yaml
+++ b/services/keycloak/vault-oidc-secret-ensure-job.yaml
@ -11,6 +11,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "sso-secrets"
        vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: "kv/data/atlas/shared/keycloak-admin"
        vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
--- a/services/mailu/mailu-sync-cronjob.yaml
+++ b/services/mailu/mailu-sync-cronjob.yaml
@ -13,6 +13,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "mailu-mailserver"
            vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
            vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |
--- a/services/mailu/mailu-sync-job.yaml
+++ b/services/mailu/mailu-sync-job.yaml
@ -9,6 +9,7 @@ spec:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/role: "mailu-mailserver"
        vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
        vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |
--- a/services/nextcloud-mail-sync/cronjob.yaml
+++ b/services/nextcloud-mail-sync/cronjob.yaml
@ -15,6 +15,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "nextcloud"
            vault.hashicorp.com/agent-inject-secret-nextcloud-env.sh: "kv/data/atlas/nextcloud/nextcloud-db"
            vault.hashicorp.com/agent-inject-template-nextcloud-env.sh: |
--- a/services/nextcloud/maintenance-cronjob.yaml
+++ b/services/nextcloud/maintenance-cronjob.yaml
@ -13,6 +13,7 @@ spec:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "nextcloud"
            vault.hashicorp.com/agent-inject-secret-nextcloud-env.sh: "kv/data/atlas/nextcloud/nextcloud-db"
            vault.hashicorp.com/agent-inject-template-nextcloud-env.sh: |