vault: rolling restart to fix raft join; remove sealedok from readiness probe

2026-05-05 03:59:33 -05:00
parent 3f08c6dc01
commit 2e5655c583
1 changed files with 12 additions and 1 deletions
@@ -103,15 +103,26 @@ spec:
            storageClass: standard-rwo
            accessMode: ReadWriteOnce
          # Annotations on the pod template — bumping rollme triggers a
          # StatefulSet rolling restart (pods 2→1→0) to pick up the
          # corrected raft retry_join addresses.
          podAnnotations:
            rollme: "2026-05-05-raft-join-fix"
          readinessProbe:
            enabled: true
-            path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
+            # standbyok=true: standby pods pass (they serve reads).
            # sealedok removed: sealed/uninit pods fail readiness so they
            # leave the service endpoints and stop receiving external traffic.
            path: "/v1/sys/health?standbyok=true"
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            enabled: true
            # Liveness keeps sealedok=true so sealed pods aren't killed —
            # they need time to join raft and auto-unseal.
            path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
            initialDelaySeconds: 60
            periodSeconds: 10