# Credential delivery for audit-core (AUDIT-WP-0005-T02).
#
# Follows the ClusterSecretStore -> ExternalSecret -> Secret pattern already in
# use by activity-core and rapp-qonto. audit-core never holds a credential in
# its own configuration; it reads whatever is currently mounted.
#
# PREREQUISITE (rapp-postgres / railiance-platform, not this repo):
#   - a ClusterSecretStore named openbao-audit-core, scoped to this namespace
#   - the OpenBao database role rapp-postgres/audit-core-runtime issuing leases
#     against the audit_core_app group role
# Apply order: ClusterSecretStore, then this, then the Deployment.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: audit-core-database
  namespace: audit-core
spec:
  # Shorter than the platform default of 1h: these are dynamic leases, and the
  # refresh interval bounds how long a revoked lease can remain mounted.
  refreshInterval: 15m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-audit-core
  target:
    name: audit-core-database
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      engineVersion: v2
      # One value per file. The pod mounts this Secret as a directory and
      # audit-core re-reads it on every connection attempt, so a rotated lease
      # takes effect without a restart and without a delivery gap.
      data:
        username: "{{ .username }}"
        password: "{{ .password }}"
        host: platform-pg-rw.databases.svc.cluster.local
        port: "5432"
        dbname: audit_core
  data:
    - secretKey: username
      remoteRef:
        key: platform/workloads/audit-core/database/audit-core-runtime
        property: username
    - secretKey: password
      remoteRef:
        key: platform/workloads/audit-core/database/audit-core-runtime
        property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: audit-core-senders
  namespace: audit-core
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-audit-core
  target:
    name: audit-core-senders
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    # The sender registry: which credential may write for which tenant and
    # source, and each sender's secret_policy. Held in OpenBao rather than the
    # manifest because it contains bearer tokens.
    #
    # Rotation is overlap-first: add the replacement to a sender's `tokens`
    # list, move the sender, then drop the predecessor. Both are valid in
    # between, so there is no delivery gap.
    - secretKey: senders.json
      remoteRef:
        key: platform/workloads/audit-core/senders
        property: senders.json