From 6b81033f704789ace6edd0d773cdc275903faf09 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Thu, 22 Oct 2026 16:11:13 +0200 Subject: [PATCH] vault: drop the injector's anti-affinity The chart requires injector pods on different nodes. With one node and one replica the rolling update to vault-k8s 1.7.6 deadlocked: the new pod stayed Pending until the old one left, which waits for the new one. The server already sets affinity to "" for the same reason. --- vault/overrides.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/vault/overrides.yaml b/vault/overrides.yaml index 3f0359a..c957e06 100644 --- a/vault/overrides.yaml +++ b/vault/overrides.yaml @@ -3,6 +3,10 @@ global: tlsDisable: true injector: enabled: true + # The chart's default anti-affinity forbids two injector pods on one + # node, so on this single node a rolling update can never start the new + # pod while the old one runs. + affinity: "" server: # Pinned to the running version: the chart would otherwise pull its own # default on the next pod restart, and with Shamir unsealing a Vault