Dominik Schön
bbbe4f8985
- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007) - skill-impact.md audit trail for skill modifications - _template.md for future pattern creation - index.md updated with Patterns section - log.md entry for this change - Inspired by arXiv:2608.27454 (WikiSkill)
52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
---
|
|
pattern_id: PAT-003
|
|
title: "1Password CLI rate-limit is account-level — stop ESO, wait 1 hour"
|
|
category: tooling
|
|
severity: high
|
|
status: active
|
|
first_observed: 2026-07
|
|
last_updated: 2026-08-30
|
|
related_systems: [rke2-kubernetes]
|
|
related_solution_docs:
|
|
- docs/solutions/architecture/2026-07-24-1password-account-level-rate-limit.md
|
|
- docs/solutions/bug-fixes/2026-07-14-1password-token-telegram-corruption.md
|
|
related_skills: [1password-cli]
|
|
---
|
|
|
|
# 1Password CLI rate-limit is account-level — stop ESO, wait 1 hour
|
|
|
|
## Symptom
|
|
|
|
All 1Password CLI (`op`) calls suddenly fail with rate-limit errors. This affects
|
|
both Hermes tools and ExternalSecrets Operator (ESO) in K8s simultaneously.
|
|
The outage lasts approximately 1 hour.
|
|
|
|
## Root Cause
|
|
|
|
The 1Password CLI enforces rate limits at the **account level**, not per-token or
|
|
per-client. When ESO polls aggressively (multiple SecretStores + frequent sync intervals),
|
|
it exhausts the quota for the ENTIRE account, blocking all other `op` callers including
|
|
Hermes automation.
|
|
|
|
## Mitigation
|
|
|
|
1. **Stop ESO immediately** — scale down the ESO deployment to halt API calls:
|
|
```bash
|
|
kubectl scale deploy -n external-secrets external-secrets-operator --replicas=0
|
|
```
|
|
2. **Wait 1 hour** — the rate limit resets automatically. No polling needed.
|
|
3. **Resume ESO** with reduced polling frequency afterward
|
|
|
|
## Prevention
|
|
|
|
- Reduce ESO `refreshInterval` to 10+ minutes (not the default 1 minute)
|
|
- Limit the number of SecretStores that reference 1Password
|
|
- Consider caching secrets locally to reduce API pressure
|
|
- Never run `op` in tight loops — always add delays for batch operations
|
|
|
|
## Evidence
|
|
|
|
- Hit twice: Jul 2026 (initial discovery) and during token corruption investigation
|
|
- Solution doc: `docs/solutions/architecture/2026-07-24-1password-account-level-rate-limit.md`
|
|
- MEMORY.md entry: "1P CLI:3 vaults R/W. Rate-limit=acct-level. Stop ESO, wait 1hr, no polling."
|