mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Sonnet 5
3226169af8
vault-init-and-store.sh minted the auth/kubernetes/config reviewer JWT via 'kubectl create token vault-auth' with no --duration, defaulting to a 1hr TTL, then wrote it into Vault as a static token_reviewer_jwt. ~1hr after every cluster boot/hook rerun it silently expired, breaking TokenReview for every kubernetes-auth login (including ESO's) with a generic 403 that logged nothing at INFO/ERROR. This was the actual root cause of today's broad ArgoCD Degraded wave across ~14 apps - not Vault's seal state, which was fine the whole time. Fix: clear token_reviewer_jwt and rely on Vault's local-JWT auto-detection (disable_local_ca_jwt=false default), which reads the vault pod's own kubelet-refreshed SA token from disk on every call instead of a static copy. The vault SA already has system:auth-delegator via the existing vault-server-binding ClusterRoleBinding. Applied live directly against Vault to unblock immediately; confirmed ClusterSecretStore vault-backend flipped to Ready=True and previously broken ExternalSecrets (guacamole, teslamate, unpoller, netbird x3) all resynced successfully. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>