From cc47da87b03fdb4e31cc472ac2ac7179ff632cc8 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Tue, 12 May 2026 13:31:33 +0000 Subject: [PATCH] payslip-ingest, instagram-poster: suspend two chronic-failure cronjobs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Identified during alert-noise review as steady sources of JobFailed. Suspending them stops the noise; unsuspend after the per-job blocker is cleared. * payslip-ingest/actualbudget-payroll-sync — blocked on Vault `secret/payslip-ingest` missing `actualbudget_encryption_password`. `actualbudget_api_key` and `actualbudget_budget_sync_id` were added (copied from `secret/fire-planner`) in the same session; the encryption password is not stored anywhere in Vault and needs to be populated separately. ExternalSecret sync has been failing since 2026-04-25. * instagram-poster/ig-refresh-token — the deployed image (:da5b4191) does not contain the `POST /ig-refresh-token` route; the route is defined in uncommitted working-copy changes at `instagram-poster/instagram_poster/app.py:695`. Unsuspend after the new image rolls. Each `suspend = true` line carries an inline comment with the unsuspend trigger. --- stacks/instagram-poster/modules/instagram-poster/main.tf | 8 ++++++++ stacks/payslip-ingest/main.tf | 7 +++++++ 2 files changed, 15 insertions(+) diff --git a/stacks/instagram-poster/modules/instagram-poster/main.tf b/stacks/instagram-poster/modules/instagram-poster/main.tf index 3d9ef98c..2308f7b1 100644 --- a/stacks/instagram-poster/modules/instagram-poster/main.tf +++ b/stacks/instagram-poster/modules/instagram-poster/main.tf @@ -542,6 +542,14 @@ resource "kubernetes_cron_job_v1" "ig_refresh_token" { labels = local.labels } spec { + # Suspended 2026-05-12 — chronic JobFailed because the deployed image + # (currently :da5b4191) doesn't yet contain the `POST /ig-refresh-token` + # FastAPI route. The route is in the working copy at + # `instagram-poster/instagram_poster/app.py:695` but uncommitted, so + # the cron returns 404 every night. Unsuspend after the new image + # rolls (commit + push to instagram-poster repo, GHA builds + Woodpecker + # deploys, then remove this `suspend = true` line). + suspend = true schedule = "0 2 * * *" concurrency_policy = "Forbid" successful_jobs_history_limit = 1 diff --git a/stacks/payslip-ingest/main.tf b/stacks/payslip-ingest/main.tf index f5f42d32..5782092f 100644 --- a/stacks/payslip-ingest/main.tf +++ b/stacks/payslip-ingest/main.tf @@ -334,6 +334,13 @@ resource "kubernetes_cron_job_v1" "actualbudget_payroll_sync" { namespace = kubernetes_namespace.payslip_ingest.metadata[0].name } spec { + # Suspended 2026-05-12 — chronic JobFailed with + # `KeyError: 'ACTUALBUDGET_API_KEY'` / `..._ENCRYPTION_PASSWORD`. + # Vault `secret/payslip-ingest` now has `actualbudget_api_key` and + # `actualbudget_budget_sync_id` (copied from `secret/fire-planner`), + # but `actualbudget_encryption_password` is still missing. Unsuspend + # by removing this line once the encryption password is in Vault. + suspend = true schedule = "0 2 * * *" concurrency_policy = "Forbid" successful_jobs_history_limit = 3