tegwick
74575c4f32
Database leases come from ClusterSecretStore openbao-audit-core-database (one extract, one lease). Senders are minted in-cluster. Secret mounts use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation stub events table. /readyz reports custody_class=archive.
73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
# Credential delivery for audit-core (AUDIT-WP-0005-T02).
|
|
#
|
|
# Two sources, because they are two kinds of secret:
|
|
# - database leases: VaultDynamicSecret -> ExternalSecret (this file)
|
|
# - sender registry: ClusterSecretStore openbao-audit-core -> ExternalSecret
|
|
#
|
|
# audit-core never holds a credential in its own configuration; it reads
|
|
# whatever is currently mounted. Apply order: namespace, ESO token,
|
|
# ClusterSecretStore, VaultDynamicSecret, this, migrate Job, Deployment.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-database
|
|
namespace: audit-core
|
|
spec:
|
|
# Shorter than the platform default of 1h: these are dynamic leases, and the
|
|
# refresh interval bounds how long a revoked lease can remain mounted.
|
|
refreshInterval: 15m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-audit-core-database
|
|
target:
|
|
name: audit-core-database
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
# One value per file. The pod mounts this Secret as a directory and
|
|
# audit-core re-reads it on every connection attempt, so a rotated lease
|
|
# takes effect without a restart and without a delivery gap.
|
|
data:
|
|
username: "{{ .username }}"
|
|
password: "{{ .password }}"
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: "5432"
|
|
dbname: audit_core
|
|
# One read = one lease. Two remoteRefs would mint two roles and pair
|
|
# username from A with password from B — auth then fails.
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/audit-core-runtime
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-database-migrate
|
|
namespace: audit-core
|
|
spec:
|
|
refreshInterval: 15m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-audit-core-database
|
|
target:
|
|
name: audit-core-database-migrate
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
username: "{{ .username }}"
|
|
password: "{{ .password }}"
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: "5432"
|
|
dbname: audit_core
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/audit-core-migration
|
|
# Sender registry is not pulled from OpenBao on first deploy
|
|
# (ops-mason/plans/audit-core-openbao-runtime-custody.md). Tokens are minted
|
|
# in-cluster into Secret audit-core-senders. Apply
|
|
# deploy/externalsecret-senders.yaml only after the Mason wrap-migrate has
|
|
# filled platform/workloads/audit-core/senders.
|