MAS-WP-0003: TEM relay login via ExternalSecret (ops-mason MASON-WP-0014)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 252470@bnt-lap001
Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241

deploy/railiance/manifests.yaml

@@ -1,7 +1,8 @@
 # MAS live provider test (mail-address-semantics MAS-WP-0003).
 # Founder go for A-D: 2026-10-08. Temporary: delete the namespace after the test.
 # A namespace + MX pod   B LoadBalancer :25   C statute-only ingress   D no outbound mail
-# D superseded 2026-10-18: operator chose replies via Scaleway TEM (Secret mas-relay).
+# D superseded 2026-10-18: operator chose replies via Scaleway TEM (Secret mas-relay,
+# synced by ExternalSecret from OpenBao platform/suppliers/scaleway/mas-tem-relay).
 # IMAGE is replaced with the pushed digest at apply time.
 apiVersion: v1
 kind: Namespace
@@ -17,6 +18,41 @@ spec:
   storageClassName: local-path
   resources: {requests: {storage: 1Gi}}
 ---
+# TEM SMTP login from OpenBao (ops-mason MASON-WP-0014, CCR-2026-0051).
+# OpenBao role external-secrets-mas-tem-relay and its read policy are
+# cluster-scoped. Retire them at MAS-WP-0003 close; deleting the namespace
+# does not remove them.
+apiVersion: v1
+kind: ServiceAccount
+metadata: {name: mas-tem-relay-eso, namespace: mas}
+automountServiceAccountToken: false
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata: {name: openbao-mas-tem-relay, namespace: mas}
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-mas-tem-relay
+          serviceAccountRef: {name: mas-tem-relay-eso, audiences: [openbao]}
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: {name: mas-relay, namespace: mas}
+spec:
+  refreshInterval: 1h
+  secretStoreRef: {name: openbao-mas-tem-relay, kind: SecretStore}
+  target: {name: mas-relay, creationPolicy: Owner}
+  data:
+    - {secretKey: username, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: username}}
+    - {secretKey: password, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: password}}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata: