# Credential delivery for audit-core (AUDIT-WP-0005-T02).
#
# Two sources, because they are two kinds of secret:
#   - database leases: VaultDynamicSecret -> ExternalSecret (this file)
#   - sender registry: ClusterSecretStore openbao-audit-core -> ExternalSecret
#
# audit-core never holds a credential in its own configuration; it reads
# whatever is currently mounted. Apply order: namespace, ESO token,
# ClusterSecretStore, VaultDynamicSecret, this, migrate Job, Deployment.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: audit-core-database
  namespace: audit-core
spec:
  # Shorter than the platform default of 1h: these are dynamic leases, and the
  # refresh interval bounds how long a revoked lease can remain mounted.
  refreshInterval: 15m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-audit-core-database
  target:
    name: audit-core-database
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      engineVersion: v2
      # One value per file. The pod mounts this Secret as a directory and
      # audit-core re-reads it on every connection attempt, so a rotated lease
      # takes effect without a restart and without a delivery gap.
      data:
        username: "{{ .username }}"
        password: "{{ .password }}"
        host: platform-pg-rw.databases.svc.cluster.local
        port: "5432"
        dbname: audit_core
  # One read = one lease. Two remoteRefs would mint two roles and pair
  # username from A with password from B — auth then fails.
  dataFrom:
    - extract:
        key: creds/audit-core-runtime
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: audit-core-database-migrate
  namespace: audit-core
spec:
  refreshInterval: 15m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-audit-core-database
  target:
    name: audit-core-database-migrate
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      engineVersion: v2
      data:
        username: "{{ .username }}"
        password: "{{ .password }}"
        host: platform-pg-rw.databases.svc.cluster.local
        port: "5432"
        dbname: audit_core
  dataFrom:
    - extract:
        key: creds/audit-core-migration
# Sender registry is not pulled from OpenBao on first deploy
# (ops-mason/plans/audit-core-openbao-runtime-custody.md). Tokens are minted
# in-cluster into Secret audit-core-senders. Apply
# deploy/externalsecret-senders.yaml only after the Mason wrap-migrate has
# filled platform/workloads/audit-core/senders.