tegwick
74575c4f32
Database leases come from ClusterSecretStore openbao-audit-core-database (one extract, one lease). Senders are minted in-cluster. Secret mounts use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation stub events table. /readyz reports custody_class=archive.
23 lines
644 B
YAML
23 lines
644 B
YAML
# Apply only after ops-mason wrap-migrate has filled
|
|
# platform/workloads/audit-core/senders. Until then the sender registry is
|
|
# Secret audit-core-senders, minted in-cluster (see operator-runbook).
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: audit-core-senders
|
|
namespace: audit-core
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-audit-core
|
|
target:
|
|
name: audit-core-senders
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: senders.json
|
|
remoteRef:
|
|
key: workloads/audit-core/senders
|
|
property: senders.json
|