coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire static OpenBao ESO token bootstrap (RPF-WP-0045-T06)

Browse source 
The openbao-activity-core store has used OpenBao Kubernetes auth since
2026-09-21 and synced cleanly for more than 24 hours. Remove the
openbao-eso-token-apply script and Makefile target, point the manifest
comments and runbooks at the Kubernetes-auth store, and guard against
reintroducing the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:47:11 +02:00
parent 94b5c45f22
commit b690ce03fa
8 changed files with 26 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

7
k8s/railiance/15-externalsecret-backup-offsite.yaml
View file

@ -1,9 +1,10 @@
# Sync Option A offsite backup credentials into actcore-runtime-secret.
#
# Prereqs on railiance01:
# - ClusterSecretStore openbao-activity-core
# - ESO token includes policy workload-kv-read-railiance-backup-offsite-lane
# (scripts/openbao-eso-token-apply.sh defaults updated in RAILIANCE-WP-0016)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
# RPF-WP-0045, 2026-09-21 — no static ESO token)
# - Store role policy includes workload-kv-read-railiance-backup-offsite-lane
#
# OpenBao path: platform/workloads/railiance/backup/offsite-lane
# Fields synced (never AGE_PRIVATE_KEY):