From 82a0930d9f1c9ab90cbfcc70312cf2833ce2dd73 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 4 Oct 2026 05:38:32 -0500
Subject: [PATCH] maintenance: spread auth helpers off quarantined workers

---
 .../maintenance/networking/oauth2-proxy-metis.yaml     | 10 ++++++++++
 .../maintenance/networking/oauth2-proxy-soteria.yaml   | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/services/maintenance/networking/oauth2-proxy-metis.yaml b/services/maintenance/networking/oauth2-proxy-metis.yaml
index 6745e104..7df25dea 100644
--- a/services/maintenance/networking/oauth2-proxy-metis.yaml
+++ b/services/maintenance/networking/oauth2-proxy-metis.yaml
@@ -34,6 +34,7 @@ spec:
         app: oauth2-proxy-metis
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-requests-cpu: "25m"
         vault.hashicorp.com/role: "maintenance"
         vault.hashicorp.com/agent-inject-secret-oidc-config: "kv/data/atlas/maintenance/metis-oidc"
         vault.hashicorp.com/agent-inject-template-oidc-config: |
@@ -54,6 +55,9 @@ spec:
                   - key: kubernetes.io/arch
                     operator: In
                     values: ["amd64","arm64"]
+                  - key: kubernetes.io/hostname
+                    operator: NotIn
+                    values: [titan-04, titan-05, titan-06, titan-08, titan-11, titan-14, titan-18]
           preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
               preference:
@@ -67,6 +71,12 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: NotIn
                     values: ["titan-13","titan-15","titan-17","titan-19"]
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: oauth2-proxy-metis
+              topologyKey: kubernetes.io/hostname
       containers:
         - name: oauth2-proxy
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
diff --git a/services/maintenance/networking/oauth2-proxy-soteria.yaml b/services/maintenance/networking/oauth2-proxy-soteria.yaml
index a21a9293..c197a51d 100644
--- a/services/maintenance/networking/oauth2-proxy-soteria.yaml
+++ b/services/maintenance/networking/oauth2-proxy-soteria.yaml
@@ -34,6 +34,7 @@ spec:
         app: oauth2-proxy-soteria
       annotations:
         vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-requests-cpu: "25m"
         vault.hashicorp.com/role: "maintenance"
         vault.hashicorp.com/agent-inject-secret-oidc-config: "kv/data/atlas/maintenance/soteria-oidc"
         vault.hashicorp.com/agent-inject-template-oidc-config: |
@@ -54,6 +55,9 @@ spec:
                   - key: kubernetes.io/arch
                     operator: In
                     values: ["amd64","arm64"]
+                  - key: kubernetes.io/hostname
+                    operator: NotIn
+                    values: [titan-04, titan-05, titan-06, titan-08, titan-11, titan-14, titan-18]
           preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
               preference:
@@ -67,6 +71,12 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: NotIn
                     values: ["titan-13","titan-15","titan-17","titan-19"]
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: oauth2-proxy-soteria
+              topologyKey: kubernetes.io/hostname
       containers:
         - name: oauth2-proxy
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0