The pre-commit and vector-test workflows failed at the clone step with
"backoff: maximum elapsed time exceeded (pods ... not found)" — a transient
k8s pod-scheduling flake, not a content failure (kubeconform passed).
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
The internal intermediate CA re-key broke CA consumers because Reloader
ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling
generic secret watching naively would restart every workload on each
Vault/VSO secret rotation, so this scopes existing auto annotations to
ConfigMaps and makes secret reload opt-in per Secret.
- set reloader ignoreSecrets: false so Secrets are watched
- convert every generic reloader.stakater.com/auto to the configmap-only
configmap.reloader.stakater.com/auto form (22 annotations, 19 files)
- add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA
consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler,
litellm, logarchiver) so CA rotation restarts them
- add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager
leaf renewal rolls kanidm
- add docs/ca-rotation.md runbook and index it
Closes#326
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Ben Vincent