tegwick
04897a149f
Ship the railiance01 deploy package (OpenBao/ESO custody, NetworkPolicy, probes), provider failure classification and suppression, T04 unit and live proof, and non-secret NK-WP-0024 hand-back evidence. Workplan finished.
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
# Credential delivery for the transactional receiver (EMAIL-WP-0004-T03).
|
|
#
|
|
# PREREQUISITES (railiance-platform, not this repo):
|
|
# - ClusterSecretStore openbao-email-connect limited to this namespace
|
|
# - OpenBao policy external-secrets-email-connect + role external-secrets-email-connect
|
|
# - Operator-provisioned KV at platform/workloads/email-connect/transactional
|
|
# (fields listed below; no secret values in Git)
|
|
# Apply order: ClusterSecretStore → this ExternalSecret → Deployment.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: email-connect-runtime
|
|
namespace: email-connect
|
|
labels:
|
|
app.kubernetes.io/name: email-connect
|
|
app.kubernetes.io/part-of: email-connect
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-email-connect
|
|
target:
|
|
name: email-connect-runtime
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
# Shared bearer for user-engine → email-connect. user-engine holds the same
|
|
# value as EMAIL_CONNECT_INGEST_TOKEN under its own custody path; this
|
|
# service never receives SMTP material from the caller.
|
|
- secretKey: EMAIL_CONNECT_INGEST_TOKEN
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_INGEST_TOKEN
|
|
- secretKey: EMAIL_CONNECT_SMTP_USERNAME
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_SMTP_USERNAME
|
|
- secretKey: EMAIL_CONNECT_SMTP_PASSWORD
|
|
remoteRef:
|
|
key: platform/workloads/email-connect/transactional
|
|
property: EMAIL_CONNECT_SMTP_PASSWORD
|