45 lines
1.7 KiB
YAML
45 lines
1.7 KiB
YAML
|
# Sync ops_run queue worker tokens from OpenBao into actcore-runtime-secret.
|
||
|
|
#
|
||
|
|
# NOT YET APPLIED (ACTIVITY-WP-0039). Apply only after T02 (railiance-platform
|
||
|
|
# adds both exact paths to the activity-core-eso role policy) and T03 (the
|
||
|
|
# founder seeds both paths). Applying earlier makes the store fail to read,
|
||
|
|
# or overwrites the hand-set ACTIVITY_CORE_WORKER_TOKEN with a missing value.
|
||
|
|
#
|
||
|
|
# Prereqs on railiance01:
|
||
|
|
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
|
||
|
|
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
|
||
|
|
# RPF-WP-0045)
|
||
|
|
#
|
||
|
|
# One path per worker identity (field: token), so a consumer lane can be
|
||
|
|
# granted exactly one worker's token:
|
||
|
|
# rein-aharness@railiance01 -> ACTIVITY_CORE_WORKER_TOKEN
|
||
|
|
# rein-aharness-metered@railiance01 -> ACTIVITY_CORE_WORKER_TOKEN_METERED
|
||
|
|
# The identity map is the non-secret ACTIVITY_CORE_WORKERS in
|
||
|
|
# actcore-runtime-config.
|
||
|
|
apiVersion: external-secrets.io/v1beta1
|
||
|
|
kind: ExternalSecret
|
||
|
|
metadata:
|
||
|
|
name: actcore-ops-run-worker-tokens
|
||
|
|
namespace: activity-core
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: activity-core
|
||
|
|
app.kubernetes.io/part-of: activity-core
|
||
|
|
spec:
|
||
|
|
refreshInterval: 1h
|
||
|
|
secretStoreRef:
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
name: openbao-activity-core
|
||
|
|
target:
|
||
|
|
name: actcore-runtime-secret
|
||
|
|
creationPolicy: Merge
|
||
|
|
deletionPolicy: Retain
|
||
|
|
data:
|
||
|
|
- secretKey: ACTIVITY_CORE_WORKER_TOKEN
|
||
|
|
remoteRef:
|
||
|
|
key: platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01
|
||
|
|
property: token
|
||
|
|
- secretKey: ACTIVITY_CORE_WORKER_TOKEN_METERED
|
||
|
|
remoteRef:
|
||
|
|
key: platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01
|
||
|
|
property: token
|