md-vault-mcd longer startup probe

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -44,6 +44,16 @@ spec:
                     name: markdown-vault-mcp-secrets
                     key: BEARER_TOKEN
             probes:
+              # first boot downloads embedding models from HuggingFace Hub
+              # and builds the vector index/embeddings before binding the
+              # port - the default liveness probe budget (periodSeconds=10,
+              # failureThreshold=3 = 30s) isn't enough, so it gets killed
+              # mid-startup on every restart, in an endless loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 36
               liveness:
                 enabled: true
               readiness:

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:ZCUAaXCDOyc/ccw/1fmp2wHxm7W+bZEIcOSn6M4/pfXjR3pNciz97lvCkHgJRsdF0TAZPyjkk/hun70p2Nlljw==,iv:tjLmQASOV75nbk6PWhDGT1LcD/FxP35fjBBi4097qic=,tag:72S8Ra51pENoJQlUzUTo4g==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:hVP/WRUO0gDojCOzOUWsyUeMWo+7X++k42xtJWvLYXsmR1ryJP3AXpHHnbAwXMba3rtUqAQ2tMUyoM/az8tmDQ==,iv:0Kt95bLhmrLTwl4Q7GlcKSt0Qfe+UUCpU+Go9j7fpa4=,tag:CRsMRNHVqvMtnSYDO1sRmA==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:49p/5QstfcIRqocAFdd+1Exvq4cZDhAmdJ77ZLKrFr79w8CvqoFwmBAZ8RS4kLIcmP4SFPxdLUE/77GKlYu1vw==,iv:wm7/7KSiXYEcsxOs0iSMPq4XHbxvlzEPqKXo5Rm796Q=,tag:jXuSxLeyBISNPt4afqekdw==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:vwze2MEFoFOy0PnvF9rPaeINJy1dOpMYW9gSEUzppxRzO4qKgyQJmCzOx5aCU1IstVPCdB/dnYu8eJQR+fr7MQ==,iv:YzC/NwwFhwrJwF97vvMTVFdyjie2ozx+tKodu+N0qD8=,tag:Wm5pqMyjobFl+3kHHKQCxA==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:vAdx8cubuuskkKnfUJkw89duAPG6r5XeUmU9kZru/ymvB7OFWBQvCeBNikzpD4zeEg0hZ1i+R5+Wna3E4E71FQ==,iv:b35VqmdY4KCZR5qgx/Sb3pcVv31bmAZvPnR67QJkQ0I=,tag:Av/wsH4KqDTLuTrujcuMIQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:YmWVKsKJye99Cqw4Dd2JYTtXh+Vr0fSJ0wl02/D/6zAQNcC7SEk3c4rAFVS75h6P4lRwwt7P42gj3eY3bvDv5Q==,iv:sU1WqQxffOtNHLq2hlYVlnYBiilhL1Mn+7YQWQad7XE=,tag:Vj7H1nyrocfw9GB50Lae7g==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT2ZqTGQ0RGFBWFNvUXFP
-            dnN5cWpnSUk1dGMvWmM2K0szNS8xMmduSWlVCm5CSHZVRzhBT2Fjc2FyTHRrRWhy
-            US9aYUVranVwVTdGdGZHdms0SituYmMKLS0tIExoemNKcm1hblpHMWtKRXM2MWV5
-            M1NGTjBGUmdSeEwzc2JBQ2NBNWg0NE0KPbp6KqA5w8XBczJdwm2EcB9yTlLPpidH
-            04dsuqmxhI5SlWCXGiOQ9y4QzcZfNNxoVEcx4WeEBTmPlFn9BPTptA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFV3dTM2NKZHM3RU5Sb1Nn
+            WFMwYzRrWXpjMTFuR2c5bm0xNVEvbEdvakJjCjIrUjJOVDBBYUVXNWRVOWdkTGRy
+            NUZ2d0grOEpEcXI1WXFOd3Z3WlNMZnMKLS0tIHdkTnBWbXB2b3loa25mUFRnV2pY
+            VERSUkVQSE5UbHZ0bDlKTS9zMGFqZ1kKOg5aTyr2eew9LDV5nteZb0mtJPaYNTzS
+            oTsVytXHkDcB94zVgcLjs1O93DpViuAwg7qhbIoxoF3s8h1LuXvd6A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:30:06Z"
-    mac: ENC[AES256_GCM,data:Z08rQEjtCp/ANzcx4Ibn5zCLdFVUKBwTNlAhDqs98I83aKRLot/OuTfXuiQAyLnkNgIcmeF9wviHxIrDSyHbvJ8SG0mSjqb9ODBqmWYwuGluDZ4oI/VbH7Hj4lRplta1cLauX9ox7IXGKVcjdqL6dl0VyApOdYjtXWrFt23yxVo=,iv:Muu76jntoCsRqdhjQR6pHtCL3QcAMSZnOiP4t5/Ur5s=,tag:t3cPNT4+Uz0T6BraD+2BfA==,type:str]
+    lastmodified: "2026-08-26T10:30:16Z"
+    mac: ENC[AES256_GCM,data:8vWl1uHoVGOEi+tcIZOVfDyvaLgC/zEDjGYJHXSF/GdpR+tFm5QS/helf1MKS3fVkbeakVSv3r4uu+caBBxS/HK3Eyp/07SitsvhR1gJi4hQWmWqRv2wwHz3EX0GcH+rMEA5durD/7q/cwtAVe30m9U6yVDNtqp3VAYAf9+z3gI=,iv:VQl7wVu/rIVaq+KFQ88RbMyPl3QlRVbXmZNFGVbf+4k=,tag:DwMXyi96MOxSSbQ1h4MPtw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0