# Dynamic PostgreSQL leases (AUDIT-WP-0005-T02).
#
# These are not KV secrets. Copying a lease into platform/workloads/... would
# freeze a rotating credential and recreate the delivery-gap problem the
# mounted directory exists to avoid. ESO's VaultDynamicSecret generator reads
# database/creds/* on each refresh and writes username/password files that
# audit-core re-reads on the next connection.
#
# Prerequisite: Secret external-secrets/openbao-audit-core-eso-token.
---
apiVersion: generators.external-secrets.io/v1alpha1
kind: VaultDynamicSecret
metadata:
  name: audit-core-runtime
  namespace: audit-core
spec:
  path: database/creds/audit-core-runtime
  method: GET
  provider:
    server: http://openbao.openbao.svc:8200
    auth:
      tokenSecretRef:
        name: openbao-audit-core-eso-token
        namespace: external-secrets
        key: token
---
apiVersion: generators.external-secrets.io/v1alpha1
kind: VaultDynamicSecret
metadata:
  name: audit-core-migration
  namespace: audit-core
spec:
  path: database/creds/audit-core-migration
  method: GET
  provider:
    server: http://openbao.openbao.svc:8200
    auth:
      tokenSecretRef:
        name: openbao-audit-core-eso-token
        namespace: external-secrets
        key: token