From 2e48f1f036bab12864b9b4e95ec2fa7242069ce6 Mon Sep 17 00:00:00 2001
From: Ioannis Tsouvalas <tsouvalasi@atic.gr>
Date: Thu, 24 Jul 2025 14:57:04 +0000
Subject: [PATCH] fix: invoke post-deploy hook before exodus export
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the ‘post-deploy’ hook invocation up in _post_deploy so it runs
immediately before the exodus metadata export (update_deployment_exodus).
This guarantees that any automatic unseal logic in the post-deploy hook
has been executed—and Vault is unsealed—before Genesis tries to
authenticate with it for metadata export.
---
 lib/Genesis/Env.pm | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/lib/Genesis/Env.pm b/lib/Genesis/Env.pm
index d084cae0..4ecb6ac9 100644
--- a/lib/Genesis/Env.pm
+++ b/lib/Genesis/Env.pm
@@ -3320,6 +3320,16 @@ sub _post_deploy {
 		$opts{'canaries'} ? "canaries=$opts{'canaries'}" : undef,
 		$opts{'max-in-flight'} ? "max-in-flight=$opts{'max-in-flight'}" : undef,
 	));
+
+	# Run post-deploy hook 
+	$self->run_hook(
+		'post-deploy',
+		rc => $state->{results}[1],
+		data => $state->{predeploy_data},
+		interactive => !$noprompt,
+		flags => $opt_flags,
+	) if $self->has_hook('post-deploy');
+
 	my $exodus_overrides = {};
 	if ($self->is_bosh_director && $self->cpi_enabled) {
 		$exodus_overrides->{default_cpi_config} = $self->cpi_name;
@@ -3356,15 +3366,6 @@ sub _post_deploy {
 		}
 	}
 
-	# Run post-deploy hook
-	$self->run_hook(
-		'post-deploy',
-		rc => $state->{results}[1],
-		data => $state->{predeploy_data},
-		interactive => !$noprompt,
-		flags => $opt_flags,
-	) if $self->has_hook('post-deploy');
-
 	# Clean up deployment state
 	delete $self->{deployment_state};