tegwick
c404c910cd
Secret volume rotation swaps ..data. Sequential reads of username then password can tear across two leases. Resolve the snapshot once. Also document why ESO AppRole login cannot parent database/creds leases: the token discard DROP ROLEs the role ESO just stored.
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
# Template of the railiance-platform add-on store. Prefer applying from:
|
|
# ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml
|
|
#
|
|
# Token auth for database/creds (see comment on tokenSecretRef).
|
|
# AppRole secret remains for a later lease-aware generator.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-audit-core
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: external-secrets
|
|
app.kubernetes.io/name: audit-core
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: platform
|
|
version: v2
|
|
auth:
|
|
# Dynamic DB leases are revoked when the requesting token dies.
|
|
# ESO AppRole login+discard therefore DROP ROLEs the lease it just
|
|
# stored. A renewable orphan token is the working ESO client for
|
|
# database/creds; the AppRole remains for a later lease-aware generator.
|
|
tokenSecretRef:
|
|
name: openbao-audit-core-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
conditions:
|
|
- namespaces:
|
|
- audit-core
|
|
---
|
|
# Database engine, not KV. Same ESO token, different mount.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-audit-core-database
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: external-secrets
|
|
app.kubernetes.io/name: audit-core
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: database
|
|
version: v1
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-audit-core-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
conditions:
|
|
- namespaces:
|
|
- audit-core
|