42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
|
# Dynamic PostgreSQL leases (AUDIT-WP-0005-T02).
|
||
|
|
#
|
||
|
|
# These are not KV secrets. Copying a lease into platform/workloads/... would
|
||
|
|
# freeze a rotating credential and recreate the delivery-gap problem the
|
||
|
|
# mounted directory exists to avoid. ESO's VaultDynamicSecret generator reads
|
||
|
|
# database/creds/* on each refresh and writes username/password files that
|
||
|
|
# audit-core re-reads on the next connection.
|
||
|
|
#
|
||
|
|
# Prerequisite: Secret external-secrets/openbao-audit-core-eso-token.
|
||
|
|
---
|
||
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
||
|
|
kind: VaultDynamicSecret
|
||
|
|
metadata:
|
||
|
|
name: audit-core-runtime
|
||
|
|
namespace: audit-core
|
||
|
|
spec:
|
||
|
|
path: database/creds/audit-core-runtime
|
||
|
|
method: GET
|
||
|
|
provider:
|
||
|
|
server: http://openbao.openbao.svc:8200
|
||
|
|
auth:
|
||
|
|
tokenSecretRef:
|
||
|
|
name: openbao-audit-core-eso-token
|
||
|
|
namespace: external-secrets
|
||
|
|
key: token
|
||
|
|
---
|
||
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
||
|
|
kind: VaultDynamicSecret
|
||
|
|
metadata:
|
||
|
|
name: audit-core-migration
|
||
|
|
namespace: audit-core
|
||
|
|
spec:
|
||
|
|
path: database/creds/audit-core-migration
|
||
|
|
method: GET
|
||
|
|
provider:
|
||
|
|
server: http://openbao.openbao.svc:8200
|
||
|
|
auth:
|
||
|
|
tokenSecretRef:
|
||
|
|
name: openbao-audit-core-eso-token
|
||
|
|
namespace: external-secrets
|
||
|
|
key: token
|