vault: rolling restart to fix raft join; remove sealedok from readiness probe

2026-05-05 03:59:33 -05:00
parent 3f08c6dc01
commit 2e5655c583
1 changed files with 12 additions and 1 deletions
@@ -103,15 +103,26 @@ spec:
            storageClass: standard-rwo
            accessMode: ReadWriteOnce

+          # Annotations on the pod template — bumping rollme triggers a
+          # StatefulSet rolling restart (pods 2→1→0) to pick up the
+          # corrected raft retry_join addresses.
+          podAnnotations:
+            rollme: "2026-05-05-raft-join-fix"
+
          readinessProbe:
            enabled: true
-            path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
+            # standbyok=true: standby pods pass (they serve reads).
+            # sealedok removed: sealed/uninit pods fail readiness so they
+            # leave the service endpoints and stop receiving external traffic.
+            path: "/v1/sys/health?standbyok=true"
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 3

          livenessProbe:
            enabled: true
+            # Liveness keeps sealedok=true so sealed pods aren't killed —
+            # they need time to join raft and auto-unseal.
            path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
            initialDelaySeconds: 60
            periodSeconds: 10