From 6a25a7681a0953fe57f08461beb2496327220acd Mon Sep 17 00:00:00 2001 From: jenkins Date: Tue, 25 Aug 2026 14:10:57 -0300 Subject: [PATCH] fix(harbor): run Vault init first in the base-image mirror Job The Job's ensure-project init container reads /vault/secrets/harbor-admin-password, but Vault appended its init container AFTER ensure-project, so the secret file was absent and the init failed. Force vault-agent-init to run first. --- services/harbor/hermes-agent-base-mirror-job.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/services/harbor/hermes-agent-base-mirror-job.yaml b/services/harbor/hermes-agent-base-mirror-job.yaml index 4c89ff38..a04b5ad5 100644 --- a/services/harbor/hermes-agent-base-mirror-job.yaml +++ b/services/harbor/hermes-agent-base-mirror-job.yaml @@ -26,6 +26,10 @@ spec: annotations: vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/agent-pre-populate-only: "true" + # This Job has an app init container (ensure-project) that reads the + # injected secret, so Vault's init must run FIRST — otherwise it is + # appended after ensure-project and the secret file isn't written yet. + vault.hashicorp.com/agent-init-first: "true" vault.hashicorp.com/agent-run-as-user: "65532" vault.hashicorp.com/agent-run-as-group: "65532" vault.hashicorp.com/role: harbor-policy-bootstrap