coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire static OpenBao ESO token bootstrap (RPF-WP-0045-T06)

Browse source 
The openbao-activity-core store has used OpenBao Kubernetes auth since
2026-09-21 and synced cleanly for more than 24 hours. Remove the
openbao-eso-token-apply script and Makefile target, point the manifest
comments and runbooks at the Kubernetes-auth store, and guard against
reintroducing the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:47:11 +02:00
parent 94b5c45f22
commit b690ce03fa
8 changed files with 26 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

9
k8s/railiance/15-externalsecret-forgejo-admin.yaml
View file

@ -2,11 +2,10 @@
#
# Prereqs on railiance01:
# - External Secrets Operator (namespace external-secrets)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon)
# - Secret external-secrets/openbao-activity-core-eso-token with policies:
# workload-kv-read-issue-core-runtime
# workload-kv-read-forgejo-admin
# (scripts/openbao-eso-token-apply.sh)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
# RPF-WP-0045, 2026-09-21 — no static ESO token)
# - Store role policy includes workload-kv-read-forgejo-admin
#
# OpenBao path: platform/workloads/forgejo/forgejo-admin
# property: API_TOKEN → secret key FORGEJO_TOKEN