From b6c671bc2337d12ebbf611e070e57f1ce3186a6b Mon Sep 17 00:00:00 2001 From: Aleksandr Bogomiakov Date: Tue, 6 Oct 2026 21:04:29 +0100 Subject: [PATCH] NG: bitwarden-cli bridge: liveness probe requires the unlocked status `bw serve` can lose its login while /sync still answers; every lookup then fails with 500. The probe now also checks /status, so the pod restarts itself. Co-Authored-By: Claude --- k8s-ng/core/secret-stores/bitwarden-cli.yaml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/k8s-ng/core/secret-stores/bitwarden-cli.yaml b/k8s-ng/core/secret-stores/bitwarden-cli.yaml index 9a07094..7194ad3 100644 --- a/k8s-ng/core/secret-stores/bitwarden-cli.yaml +++ b/k8s-ng/core/secret-stores/bitwarden-cli.yaml @@ -62,15 +62,19 @@ spec: containerPort: 8087 protocol: TCP livenessProbe: + # Syncs the vault and requires the bridge to be logged in: `bw serve` can + # lose its login (status "unauthenticated") while /sync still answers, and + # every lookup then fails with 500. Failing the probe restarts the pod. exec: command: - - wget - - -q - - http://127.0.0.1:8087/sync - - --post-data='' + - sh + - -c + - >- + wget -q -O /dev/null --post-data='' http://127.0.0.1:8087/sync && + wget -q -O - http://127.0.0.1:8087/status | grep -q '"status":"unlocked"' initialDelaySeconds: 20 failureThreshold: 3 - timeoutSeconds: 1 + timeoutSeconds: 10 periodSeconds: 120 readinessProbe: tcpSocket: