From 054117ad6daed6489c842c9b2cc25f13f8a5b781 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 20 Oct 2026 15:45:55 +0200 Subject: [PATCH] vault: point External Secrets at the in-cluster Vault service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The store went through https://vault.rubenhensen.nl, so via Hetzner and the home internet connection. When home internet dropped, the store validation failed and External Secrets backed off long enough that it needed a controller restart after the connection came back. vault-active.vault.svc talks to the active Vault pod directly. It's plain HTTP, same as the ingress → Vault hop already is. --- vault/secret-store.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/vault/secret-store.yaml b/vault/secret-store.yaml index e15236d..e2deb5a 100644 --- a/vault/secret-store.yaml +++ b/vault/secret-store.yaml @@ -5,7 +5,9 @@ metadata: spec: provider: vault: - server: "https://vault.rubenhensen.nl" + # In-cluster, so syncing secrets doesn't depend on Hetzner or the home + # internet connection. Plain HTTP, like the ingress → Vault hop. + server: "http://vault-active.vault.svc:8200" path: "kv" # Version is the Vault KV secret engine version. # This can be either "v1" or "v2", defaults to "v2"