From 52d85459520c0a1da26f2db74448be9c094bbac8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 13 Aug 2026 10:42:59 +0200 Subject: [PATCH] Cut audit-core ClusterSecretStores over to the Mason AppRole --- deploy/clustersecretstore.yaml | 40 +++++++++++-------- ...ostgres-store-and-production-deployment.md | 10 ++++- 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/deploy/clustersecretstore.yaml b/deploy/clustersecretstore.yaml index fe096a8..5228ca8 100644 --- a/deploy/clustersecretstore.yaml +++ b/deploy/clustersecretstore.yaml @@ -1,10 +1,9 @@ # Template of the railiance-platform add-on store. Prefer applying from: # ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml # -# Do not apply until Secret external-secrets/openbao-audit-core-eso-token exists -# (scripts/openbao-eso-token-apply.sh). This store is KV-only: sender registry -# lives at platform/workloads/audit-core/senders. Database leases use the -# sibling store openbao-audit-core-database (engine path, not KV). +# AppRole auth (ops-mason plan audit-core-openbao-runtime-custody). +# Prerequisite: Secret external-secrets/openbao-audit-core-approle +# (role-id / secret-id), delivered by mason phase 4. --- apiVersion: external-secrets.io/v1 kind: ClusterSecretStore @@ -17,22 +16,25 @@ metadata: spec: provider: vault: - # In-cluster OpenBao on railiance01, not the public bao.coulomb.social UI. server: http://openbao.openbao.svc:8200 path: platform version: v2 auth: - tokenSecretRef: - name: openbao-audit-core-eso-token - namespace: external-secrets - key: token + appRole: + path: approle + roleRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: role-id + secretRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: secret-id conditions: - namespaces: - audit-core --- -# Database engine, not KV. Same ESO token, different mount. Generators cannot -# read a token Secret from another namespace, so leases come through this -# store rather than VaultDynamicSecret. +# Database engine, not KV. Same AppRole, different mount. apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: @@ -48,10 +50,16 @@ spec: path: database version: v1 auth: - tokenSecretRef: - name: openbao-audit-core-eso-token - namespace: external-secrets - key: token + appRole: + path: approle + roleRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: role-id + secretRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: secret-id conditions: - namespaces: - audit-core diff --git a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md index c1952c8..83d8343 100644 --- a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md +++ b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md @@ -213,8 +213,14 @@ are `SecretSynced`. ops-mason plan founder approve to replace the interim ESO token with an AppRole. Catalog draft: `warden route find "audit-core senders" --all`. -Remaining before T02 done: approve the Mason plan (AppRole cutover + empty -KV path), then a live rotation drill. Unseal OpenBao only if it is sealed. +Mason plan approved 2026-08-13 and built: AppRole +`external-secrets-audit-core`, Secret `openbao-audit-core-approle`, both +ClusterSecretStores on AppRole and `Valid`. Interim ESO token Secret +removed. Receiver stayed Ready. + +Remaining before T02 done: a live rotation drill (refresh lease, confirm +no delivery gap). Empty senders KV path is a later wrap-migrate, not a +founder paste. ## T03 - Deploy the receiver