Complete user-engine runtime custody

sso-mfa/k8s/user-engine/README.md

@@ -13,10 +13,13 @@ package read was verified without an image pull Secret; publishing still uses
 the ExternalSecret-backed credential and temporary client state.
 
 The CloudNativePG operator creates `user-engine-pg-app`, including its `uri`
-field. `user-engine-runtime` contains only the generated edge marker and must
-be replaced by an ExternalSecret before public exposure.
+field. OpenBao is authoritative for the portal edge marker and provisioner
+service token at `platform/workloads/user-engine/runtime`. The
+`openbao-runtime.yaml` stores and ExternalSecrets deliver those values into the
+existing namespaced Secret names without changing application interfaces.
 
 ```bash
+kubectl apply -f openbao-runtime.yaml
 kubectl apply -f runtime.yaml
 kubectl -n user-engine rollout status deployment/user-engine
 kubectl -n user-engine get cluster,pod,service,networkpolicy

sso-mfa/k8s/user-engine/openbao-runtime.yaml

@@ -0,0 +1,122 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-user-engine-runtime
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: secret-delivery
+spec:
+  conditions:
+    - namespaces: [user-engine]
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: platform
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-user-engine-runtime-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-user-engine-runtime-approle
+            namespace: external-secrets
+            key: secret-id
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-sso-user-engine-runtime
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: secret-delivery
+spec:
+  conditions:
+    - namespaces: [sso]
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: platform
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-sso-user-engine-runtime-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-sso-user-engine-runtime-approle
+            namespace: external-secrets
+            key: secret-id
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: user-engine-runtime
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine
+    app.kubernetes.io/part-of: user-engine
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-user-engine-runtime
+  target:
+    name: user-engine-runtime
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: proxy-secret
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROXY_SECRET
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: identity-provisioner-client
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine
+    app.kubernetes.io/part-of: user-engine
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-user-engine-runtime
+  target:
+    name: identity-provisioner-client
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROVISIONER_TOKEN
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: identity-provisioner-token
+  namespace: sso
+  labels:
+    app.kubernetes.io/name: identity-provisioner
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-sso-user-engine-runtime
+  target:
+    name: identity-provisioner-token
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROVISIONER_TOKEN