- Shipped
- August 6, 2026 at 8:10 PM UTC
- Author
- Kamo
- Commit
- caa28f2
LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package containing a signable document rather than create assignments whose envelopes could never exist. Mount *** (key **************** and map it onto internal.auth.secret. That key does NOT relaxed-bind to internal.auth.secret on its own, which is why both the envFrom entry and the configmap mapping are needed. It is deliberately NOT mlos-internal-auth: that secret holds a different value, and ESigService's EsignInternalController compares X-Internal-Auth against esig.internal-auth-secret, which is itself sourced from *** — the wrong one 403s every send. Also raise the memory limit 1Gi -> 2Gi per the design note.