From e15b170659074579be9f75b8ecefd8fa325cbf07 Mon Sep 17 00:00:00 2001 From: ic-builder Date: Sun, 6 Sep 2026 11:38:23 -0500 Subject: [PATCH] =?UTF-8?q?fix(alerting):=20dead-man=20heartbeat=20never?= =?UTF-8?q?=20pushed=20=E2=80=94=20secret=20unavailable=20in=20runtime=20t?= =?UTF-8?q?emplates?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit HA runtime template contexts (shell_command {{ }} rendering) cannot read secrets.yaml; kuma_push_url rendered undefined every fire and the Kuma push dead-man never sent a beat. Move the full curl command into the secret (kuma_heartbeat_cmd) and reference it with !secret, which is substituted at config parse where secrets work. On-box fix applied + verified under GLPI CR 21; this commit makes the git copy match the deployed state. Ticket: https://projects.knownelement.com/issues/811 CR: https://cmdb.knownelement.com/front/change.form.php?id=21 --- packages/deploy_pipeline.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/deploy_pipeline.yaml b/packages/deploy_pipeline.yaml index a9d8c5a..cf8fa40 100644 --- a/packages/deploy_pipeline.yaml +++ b/packages/deploy_pipeline.yaml @@ -25,4 +25,4 @@ rest: # pushing — crash, wedge, power loss, network partition — Kuma pages # the founder's phone directly. No HA in the alert loop. shell_command: - kuma_ha_heartbeat: 'curl -sS -m 15 "{{ kuma_push_url }}"' + kuma_ha_heartbeat: !secret kuma_heartbeat_cmd # CR21 2026-09-06: runtime template contexts cannot read secrets; the old {{ }} form rendered undefined and the dead-man never pushed