76 lines
2.6 KiB
YAML
76 lines
2.6 KiB
YAML
|
# Credential delivery for audit-core (AUDIT-WP-0005-T02).
|
||
|
|
#
|
||
|
|
# Follows the ClusterSecretStore -> ExternalSecret -> Secret pattern already in
|
||
|
|
# use by activity-core and rapp-qonto. audit-core never holds a credential in
|
||
|
|
# its own configuration; it reads whatever is currently mounted.
|
||
|
|
#
|
||
|
|
# PREREQUISITE (rapp-postgres / railiance-platform, not this repo):
|
||
|
|
# - a ClusterSecretStore named openbao-audit-core, scoped to this namespace
|
||
|
|
# - the OpenBao database role rapp-postgres/audit-core-runtime issuing leases
|
||
|
|
# against the audit_core_app group role
|
||
|
|
# Apply order: ClusterSecretStore, then this, then the Deployment.
|
||
|
|
---
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ExternalSecret
|
||
|
|
metadata:
|
||
|
|
name: audit-core-database
|
||
|
|
namespace: audit-core
|
||
|
|
spec:
|
||
|
|
# Shorter than the platform default of 1h: these are dynamic leases, and the
|
||
|
|
# refresh interval bounds how long a revoked lease can remain mounted.
|
||
|
|
refreshInterval: 15m
|
||
|
|
secretStoreRef:
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
name: openbao-audit-core
|
||
|
|
target:
|
||
|
|
name: audit-core-database
|
||
|
|
creationPolicy: Owner
|
||
|
|
deletionPolicy: Retain
|
||
|
|
template:
|
||
|
|
engineVersion: v2
|
||
|
|
# One value per file. The pod mounts this Secret as a directory and
|
||
|
|
# audit-core re-reads it on every connection attempt, so a rotated lease
|
||
|
|
# takes effect without a restart and without a delivery gap.
|
||
|
|
data:
|
||
|
|
username: "{{ .username }}"
|
||
|
|
password: "{{ .password }}"
|
||
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
||
|
|
port: "5432"
|
||
|
|
dbname: audit_core
|
||
|
|
data:
|
||
|
|
- secretKey: username
|
||
|
|
remoteRef:
|
||
|
|
key: platform/workloads/audit-core/database/audit-core-runtime
|
||
|
|
property: username
|
||
|
|
- secretKey: password
|
||
|
|
remoteRef:
|
||
|
|
key: platform/workloads/audit-core/database/audit-core-runtime
|
||
|
|
property: password
|
||
|
|
---
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ExternalSecret
|
||
|
|
metadata:
|
||
|
|
name: audit-core-senders
|
||
|
|
namespace: audit-core
|
||
|
|
spec:
|
||
|
|
refreshInterval: 1h
|
||
|
|
secretStoreRef:
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
name: openbao-audit-core
|
||
|
|
target:
|
||
|
|
name: audit-core-senders
|
||
|
|
creationPolicy: Owner
|
||
|
|
deletionPolicy: Retain
|
||
|
|
data:
|
||
|
|
# The sender registry: which credential may write for which tenant and
|
||
|
|
# source, and each sender's secret_policy. Held in OpenBao rather than the
|
||
|
|
# manifest because it contains bearer tokens.
|
||
|
|
#
|
||
|
|
# Rotation is overlap-first: add the replacement to a sender's `tokens`
|
||
|
|
# list, move the sender, then drop the predecessor. Both are valid in
|
||
|
|
# between, so there is no delivery gap.
|
||
|
|
- secretKey: senders.json
|
||
|
|
remoteRef:
|
||
|
|
key: platform/workloads/audit-core/senders
|
||
|
|
property: senders.json
|