From 74c00cc7b7bfd011daa50776a9140d91ebe0d5d3 Mon Sep 17 00:00:00 2001 From: chemavx Date: Mon, 22 Jun 2026 10:57:13 +0000 Subject: [PATCH] vaultwarden: repoint envFrom to vaultwarden-secret-infisical + Recreate strategy Cut the Deployment over to the Infisical-synced Secret and switch to Recreate (SQLite/WAL on a RWO PVC must not have two writers during a roll). Applied via kubectl (not ArgoCD-managed). Co-Authored-By: Claude Opus 4.8 --- vaultwarden/deployment-vaultwarden.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/vaultwarden/deployment-vaultwarden.yaml b/vaultwarden/deployment-vaultwarden.yaml index 3adccad..afb363a 100644 --- a/vaultwarden/deployment-vaultwarden.yaml +++ b/vaultwarden/deployment-vaultwarden.yaml @@ -15,11 +15,11 @@ spec: selector: matchLabels: app: vaultwarden + # Single-replica vaultwarden on a RWO local-path PVC (SQLite + WAL): Recreate + # avoids two pods briefly racing the same db.sqlite3 during a roll + # (RollingUpdate surges a 2nd pod first). strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 25% - type: RollingUpdate + type: Recreate template: metadata: labels: @@ -33,7 +33,7 @@ spec: value: 'true' envFrom: - secretRef: - name: vaultwarden-secret + name: vaultwarden-secret-infisical image: vaultwarden/server:1.35.4 imagePullPolicy: Always name: vaultwarden