From d19feb16594cf23812ab433521af524fd5e4be26 Mon Sep 17 00:00:00 2001 From: jenkins Date: Wed, 5 Aug 2026 22:56:45 -0300 Subject: [PATCH] fix(vault-injector): run two replicas so restarts cannot skip injection The webhook is failurePolicy: Ignore, so with one replica any pod created during an injector restart is admitted without its Vault agent sidecar and then crash-loops forever on a missing /vault/secrets file, with nothing to indicate injection was skipped. Hit twice while rolling ariadne. Co-Authored-By: Claude Fable 5 --- infrastructure/vault-injector/helmrelease.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/infrastructure/vault-injector/helmrelease.yaml b/infrastructure/vault-injector/helmrelease.yaml index d7852737f..4b305675b 100644 --- a/infrastructure/vault-injector/helmrelease.yaml +++ b/infrastructure/vault-injector/helmrelease.yaml @@ -33,7 +33,12 @@ spec: enabled: false injector: enabled: true - replicas: 1 + # Two replicas because the webhook is failurePolicy: Ignore. With a + # single replica, any pod created while the injector restarts is + # admitted unmutated: it comes up without its Vault agent sidecar, + # never finds /vault/secrets, and crash-loops indefinitely with no + # indication that injection was skipped. Observed twice on ariadne. + replicas: 2 agentImage: repository: hashicorp/vault tag: "1.17.6"