Add an explicit ArgoCD sync and health-poll script

infra/helm/medical-chatbot/templates/ai-service.yaml

@@ -81,6 +81,25 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: postgres-dsn
+            {{- if .Values.aws.region }}
+            - name: AWS_REGION
+              value: {{ .Values.aws.region | quote }}
+            {{- end }}
+            {{- if .Values.aws.staticCredentials.enabled }}
+            # Only rendered for clusters with no instance role / IRSA; see the
+            # `aws` block in values.yaml. Environment variables take precedence
+            # over the instance role, so this must stay off on AWS-hosted nodes.
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: aws-access-key-id
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "medical-chatbot.secretName" . }}
+                  key: aws-secret-access-key
+            {{- end }}
           readinessProbe:
             httpGet: { path: /ready, port: http }
             initialDelaySeconds: 5

infra/helm/medical-chatbot/templates/auth-service.yaml

@@ -67,16 +67,6 @@ spec:
                 secretKeyRef:
                   name: {{ include "medical-chatbot.secretName" . }}
                   key: jwt-secret
-            - name: ADMIN_SEED_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "medical-chatbot.secretName" . }}
-                  key: admin-seed-password
-            - name: DEMO_SEED_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "medical-chatbot.secretName" . }}
-                  key: demo-seed-password
         {{- end }}
       {{- end }}
       containers:

infra/helm/medical-chatbot/templates/secret.yaml

@@ -20,10 +20,4 @@ stringData:
   secret here would let anyone forge an admin JWT. */}}
   jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
   {{- end }}
-  {{- if .Values.authService.seed.enabled }}
-  {{/* Required (not defaulted) once the seed job runs — see the comment on
-  secret.adminSeedPassword in values.yaml for why "1" must never reach here. */}}
-  admin-seed-password: {{ required "secret.adminSeedPassword is required when authService.seed.enabled" .Values.secret.adminSeedPassword | quote }}
-  demo-seed-password: {{ required "secret.demoSeedPassword is required when authService.seed.enabled" .Values.secret.demoSeedPassword | quote }}
-  {{- end }}
 {{- end }}