claude-botandClaude Opus 5
a88bebc76d
Found by the pr-review bot on #751, and it is the exact failure this design was written to avoid. BOUNCER_KEY_edge is consumed as an env var from a secretKeyRef, and env is fixed at pod start. The Reloader annotation listed only crowdsec-bouncer-key, so a rotation of the edge key would update OpenBao, sync into the Secret, and reach the hosts through the Ansible play — while the LAPI kept the old value in its environment and went on trusting the old key. The bouncers would then present the new one and get 401s, at exactly the moment the rotation was supposed to be seamless. The comment directly above that annotation already stated the rule — "it's an env-var secret, so a restart is required to pick up a rotated key". I added a second env-var secret and did not extend the list. Comma-separated, matching shelly-manager-deployment.yaml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>