From b86942077a4b0b77da397df0a386fa27967c8958 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Thu, 22 Oct 2026 16:22:59 +0200 Subject: [PATCH] vault: recreate the injector instead of rolling it Dropping the anti-affinity wasn't enough: during the rollout the old ReplicaSet kept recreating its pod with the old anti-affinity, which still blocked the new one. Recreate stops the old pod first; nothing uses the injector, so the short gap doesn't matter. --- vault/overrides.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/vault/overrides.yaml b/vault/overrides.yaml index c957e06..ea3ebb8 100644 --- a/vault/overrides.yaml +++ b/vault/overrides.yaml @@ -5,8 +5,12 @@ injector: enabled: true # The chart's default anti-affinity forbids two injector pods on one # node, so on this single node a rolling update can never start the new - # pod while the old one runs. + # pod while the old one runs. Recreate removes the old pod first, which + # also gets past pods that still carry the old anti-affinity. affinity: "" + strategy: + type: Recreate + rollingUpdate: null server: # Pinned to the running version: the chart would otherwise pull its own # default on the next pod restart, and with Shamir unsealing a Vault