titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

fix(harbor): run Vault init first in the base-image mirror Job

Browse Source 
The Job's ensure-project init container reads /vault/secrets/harbor-admin-password,
but Vault appended its init container AFTER ensure-project, so the secret file
was absent and the init failed. Force vault-agent-init to run first.
This commit is contained in:
jenkins 2026-08-25 14:10:57 -03:00
parent 8a71084585
commit 6a25a7681a
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
services/harbor/hermes-agent-base-mirror-job.yaml
View File

@ -26,6 +26,10 @@ spec:
annotations:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
# This Job has an app init container (ensure-project) that reads the
# injected secret, so Vault's init must run FIRST — otherwise it is
# appended after ensure-project and the secret file isn't written yet.
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-run-as-user: "65532"
vault.hashicorp.com/agent-run-as-group: "65532"
vault.hashicorp.com/role: harbor-policy-bootstrap