START-HERE.md is visible in the Hermes dashboard, so its wording is part of
what an operator sees. Describing the runbook as a five-minute demonstration
frames the automation as a set piece rather than as something that runs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ananke, pegasus and atlasbot were triaged but mapped to no repository, so
their failures could produce neither an issue nor a pull request. All three
exist on main and are non-empty. data-prepper is deliberately absent: it has
no repository under bstein.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The agent init container is appended by default, so init-config ran before
/vault/secrets existed and fell back to the Secret every time. The values were
identical, so the migration appeared to work while Vault was never actually
read.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Claude subscription OAuth token was created as a manual kubectl Secret in
the interest of demo time, with migration to Vault agreed as follow-up. The
value now lives at kv/atlas/hermes/agent-tokens and is injected as a file.
The hermes role gains that path and binds the hermes-triage service account
the deployment actually runs as; it previously bound only hermes-vault. The
init container prefers the Vault file and falls back to the Secret, so this
can be rolled back by removing the annotations alone, and the Secret should be
deleted once Vault has been serving it for a while.
Vault was reachable all along without the operator credential: Ariadne already
holds a vault-admin Kubernetes auth role, which is how the value was written.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The earlier probe fix addressed slow /health responses under load, but the
restarts continued with a different signature: connection refused rather than
timeout, meaning the app was not listening yet. Ariadne runs migrations and
builds its cron schedule before binding, which can outlast what liveness
allows from initialDelaySeconds, so the kubelet kept restarting a pod that
was merely still starting.
Add a startupProbe granting up to five minutes to come up, after which
liveness takes over unchanged. This is the case startupProbe exists for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Without the junit plugin the pipeline's junit step throws NoSuchMethodError,
jenkins.failed_tests is always empty, and auto-triage has only raw console
text to reason from. That was the root of two separate diagnosis failures:
the enforced failure being crowded out of the evidence budget, and the
patcher being unable to locate the defective source file.
Pinned to junit 1369.v15da_00283f06, the newest release that runs on core
2.528.3 - the current 1418 requires 2.533. scm-api moves 724 -> 728 because
the workflow-cps these pull in requires it; verified the whole 30-plugin
dependency closure needs no core newer than 2.528.3, and rehearsed the exact
jenkins-plugin-cli install in a throwaway pod before committing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The liveness probe used the default timeoutSeconds of 1. The auto-triage tick
runs every minute and spends most of it waiting on Jenkins, OpenSearch, Gitea
and Hermes, so against a 500m CPU limit /health occasionally answers in over a
second. Three of those and the container is killed, dropping triage ticks for
the length of a restart. Observed 11 times in 139 minutes, with the pod
sitting 1/2 Ready and restarting repeatedly.
Give both probes a 5s timeout and let liveness tolerate five failures, so a
busy tick is no longer mistaken for a hung process.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
