tegwick
73702b7e1a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
52 lines
2 KiB
YAML
52 lines
2 KiB
YAML
# Credential delivery for the transactional receiver (EMAIL-WP-0004-T03).
|
|
#
|
|
# PREREQUISITES (railiance-platform, not this repo):
|
|
# - ClusterSecretStore openbao-email-connect limited to this namespace
|
|
# - OpenBao policy external-secrets-email-connect + role external-secrets-email-connect
|
|
# - Operator-provisioned KV at platform/workloads/email-connect/transactional
|
|
# (fields listed below; no secret values in Git)
|
|
# Apply order: ClusterSecretStore → this ExternalSecret → Deployment.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: email-connect-runtime
|
|
namespace: email-connect
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-email-connect
|
|
target:
|
|
# Explicit target metadata prevents ESO copying source last-applied annotations.
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: '0'
|
|
name: email-connect-runtime
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
# Shared bearer for user-engine → email-connect. user-engine holds the same
|
|
# value as EMAIL_CONNECT_INGEST_TOKEN under its own custody path; this
|
|
# service never receives SMTP material from the caller.
|
|
- secretKey: EMAIL_CONNECT_INGEST_TOKEN
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_INGEST_TOKEN
|
|
- secretKey: EMAIL_CONNECT_SMTP_USERNAME
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_SMTP_USERNAME
|
|
- secretKey: EMAIL_CONNECT_SMTP_PASSWORD
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_SMTP_PASSWORD
|