tegwick
3a7d63e18f
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the migration lease. Image base is digest-pinned. Namespace and NetworkPolicies are on the cluster; Deployment waits for the attended OpenBao ESO token.
94 lines
3 KiB
YAML
94 lines
3 KiB
YAML
# Credential delivery for audit-core (AUDIT-WP-0005-T02).
|
|
#
|
|
# Two sources, because they are two kinds of secret:
|
|
# - database leases: VaultDynamicSecret -> ExternalSecret (this file)
|
|
# - sender registry: ClusterSecretStore openbao-audit-core -> ExternalSecret
|
|
#
|
|
# audit-core never holds a credential in its own configuration; it reads
|
|
# whatever is currently mounted. Apply order: namespace, ESO token,
|
|
# ClusterSecretStore, VaultDynamicSecret, this, migrate Job, Deployment.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-database
|
|
namespace: audit-core
|
|
spec:
|
|
# Shorter than the platform default of 1h: these are dynamic leases, and the
|
|
# refresh interval bounds how long a revoked lease can remain mounted.
|
|
refreshInterval: 15m
|
|
target:
|
|
name: audit-core-database
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
# One value per file. The pod mounts this Secret as a directory and
|
|
# audit-core re-reads it on every connection attempt, so a rotated lease
|
|
# takes effect without a restart and without a delivery gap.
|
|
data:
|
|
username: "{{ .username }}"
|
|
password: "{{ .password }}"
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: "5432"
|
|
dbname: audit_core
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: VaultDynamicSecret
|
|
name: audit-core-runtime
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-database-migrate
|
|
namespace: audit-core
|
|
spec:
|
|
refreshInterval: 15m
|
|
target:
|
|
name: audit-core-database-migrate
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
username: "{{ .username }}"
|
|
password: "{{ .password }}"
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: "5432"
|
|
dbname: audit_core
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: VaultDynamicSecret
|
|
name: audit-core-migration
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-senders
|
|
namespace: audit-core
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-audit-core
|
|
target:
|
|
name: audit-core-senders
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
# The sender registry: which credential may write for which tenant and
|
|
# source, and each sender's secret_policy. Held in OpenBao rather than the
|
|
# manifest because it contains bearer tokens.
|
|
#
|
|
# Rotation is overlap-first: add the replacement to a sender's `tokens`
|
|
# list, move the sender, then drop the predecessor. Both are valid in
|
|
# between, so there is no delivery gap.
|
|
- secretKey: senders.json
|
|
remoteRef:
|
|
# CSS already mounts KV path `platform`; do not repeat the prefix.
|
|
key: workloads/audit-core/senders
|
|
property: senders.json
|