tegwick
3a7d63e18f
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the migration lease. Image base is digest-pinned. Namespace and NetworkPolicies are on the cluster; Deployment waits for the attended OpenBao ESO token.
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
# Dynamic PostgreSQL leases (AUDIT-WP-0005-T02).
|
|
#
|
|
# These are not KV secrets. Copying a lease into platform/workloads/... would
|
|
# freeze a rotating credential and recreate the delivery-gap problem the
|
|
# mounted directory exists to avoid. ESO's VaultDynamicSecret generator reads
|
|
# database/creds/* on each refresh and writes username/password files that
|
|
# audit-core re-reads on the next connection.
|
|
#
|
|
# Prerequisite: Secret external-secrets/openbao-audit-core-eso-token.
|
|
---
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: audit-core-runtime
|
|
namespace: audit-core
|
|
spec:
|
|
path: database/creds/audit-core-runtime
|
|
method: GET
|
|
provider:
|
|
server: http://openbao.openbao.svc:8200
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-audit-core-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
---
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: audit-core-migration
|
|
namespace: audit-core
|
|
spec:
|
|
path: database/creds/audit-core-migration
|
|
method: GET
|
|
provider:
|
|
server: http://openbao.openbao.svc:8200
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-audit-core-eso-token
|
|
namespace: external-secrets
|
|
key: token
|