From 5f3f31849c8fb15d0ac9e09d4acc7e146a96c385 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sat, 3 Oct 2026 01:18:45 -0500
Subject: [PATCH] vault: keep injector replicas on separate workers

---
 infrastructure/vault-injector/helmrelease.yaml   | 16 ++++++++++++++++
 infrastructure/vault-injector/kustomization.yaml |  1 +
 .../vault-injector/poddisruptionbudget.yaml      | 13 +++++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 infrastructure/vault-injector/poddisruptionbudget.yaml

diff --git a/infrastructure/vault-injector/helmrelease.yaml b/infrastructure/vault-injector/helmrelease.yaml
index 08bbb20c..386f70e6 100644
--- a/infrastructure/vault-injector/helmrelease.yaml
+++ b/infrastructure/vault-injector/helmrelease.yaml
@@ -39,6 +39,13 @@ spec:
       # never finds /vault/secrets, and crash-loops indefinitely with no
       # indication that injection was skipped. Observed twice on ariadne.
       replicas: 2
+      resources:
+        requests:
+          cpu: 50m
+          memory: 128Mi
+        limits:
+          cpu: 500m
+          memory: 256Mi
       agentImage:
         repository: hashicorp/vault
         tag: "1.17.6"
@@ -49,6 +56,15 @@ spec:
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
       affinity:
+        # Preserve the chart's spreading rule when adding node preferences.
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: vault-injector
+                  app.kubernetes.io/name: vault-agent-injector
+                  component: webhook
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
diff --git a/infrastructure/vault-injector/kustomization.yaml b/infrastructure/vault-injector/kustomization.yaml
index b4db0892..ce5a5e39 100644
--- a/infrastructure/vault-injector/kustomization.yaml
+++ b/infrastructure/vault-injector/kustomization.yaml
@@ -3,3 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helmrelease.yaml
+  - poddisruptionbudget.yaml
diff --git a/infrastructure/vault-injector/poddisruptionbudget.yaml b/infrastructure/vault-injector/poddisruptionbudget.yaml
new file mode 100644
index 00000000..f08bd359
--- /dev/null
+++ b/infrastructure/vault-injector/poddisruptionbudget.yaml
@@ -0,0 +1,13 @@
+# infrastructure/vault-injector/poddisruptionbudget.yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: vault-injector
+  namespace: vault
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: vault-injector
+      app.kubernetes.io/name: vault-agent-injector
+      component: webhook