Files

T

Dominik Schön bbbe4f8985 feat: patterns/ directory + skill-impact tracker (WikiSkill-inspired)

- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007)
- skill-impact.md audit trail for skill modifications
- _template.md for future pattern creation
- index.md updated with Patterns section
- log.md entry for this change
- Inspired by arXiv:2608.27454 (WikiSkill)

2026-08-30 11:16:19 +00:00

1.9 KiB

Raw Blame History

pattern_id, title, category, severity, status, first_observed, last_updated, related_systems, related_solution_docs, related_skills

pattern_id

title

1Password CLI rate-limit is account-level — stop ESO, wait 1 hour

Symptom

All 1Password CLI (op) calls suddenly fail with rate-limit errors. This affects both Hermes tools and ExternalSecrets Operator (ESO) in K8s simultaneously. The outage lasts approximately 1 hour.

Root Cause

The 1Password CLI enforces rate limits at the account level, not per-token or per-client. When ESO polls aggressively (multiple SecretStores + frequent sync intervals), it exhausts the quota for the ENTIRE account, blocking all other op callers including Hermes automation.

Mitigation

Stop ESO immediately — scale down the ESO deployment to halt API calls:

kubectl scale deploy -n external-secrets external-secrets-operator --replicas=0

Wait 1 hour — the rate limit resets automatically. No polling needed.
Resume ESO with reduced polling frequency afterward

Prevention

Reduce ESO refreshInterval to 10+ minutes (not the default 1 minute)
Limit the number of SecretStores that reference 1Password
Consider caching secrets locally to reduce API pressure
Never run op in tight loops — always add delays for batch operations

Evidence

Hit twice: Jul 2026 (initial discovery) and during token corruption investigation
Solution doc: docs/solutions/architecture/2026-07-24-1password-account-level-rate-limit.md
MEMORY.md entry: "1P CLI:3 vaults R/W. Rate-limit=acct-level. Stop ESO, wait 1hr, no polling."

1.9 KiB Raw Blame History