Complete user-engine runtime custody

sso-mfa/k8s/user-engine/openbao-runtime.yaml

@@ -0,0 +1,122 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-user-engine-runtime
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: secret-delivery
+spec:
+  conditions:
+    - namespaces: [user-engine]
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: platform
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-user-engine-runtime-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-user-engine-runtime-approle
+            namespace: external-secrets
+            key: secret-id
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-sso-user-engine-runtime
+  labels:
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+    net-kingdom/component: secret-delivery
+spec:
+  conditions:
+    - namespaces: [sso]
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: platform
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-sso-user-engine-runtime-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-sso-user-engine-runtime-approle
+            namespace: external-secrets
+            key: secret-id
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: user-engine-runtime
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine
+    app.kubernetes.io/part-of: user-engine
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-user-engine-runtime
+  target:
+    name: user-engine-runtime
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: proxy-secret
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROXY_SECRET
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: identity-provisioner-client
+  namespace: user-engine
+  labels:
+    app.kubernetes.io/name: user-engine
+    app.kubernetes.io/part-of: user-engine
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-user-engine-runtime
+  target:
+    name: identity-provisioner-client
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROVISIONER_TOKEN
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: identity-provisioner-token
+  namespace: sso
+  labels:
+    app.kubernetes.io/name: identity-provisioner
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-sso-user-engine-runtime
+  target:
+    name: identity-provisioner-token
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: workloads/user-engine/runtime
+        property: PROVISIONER_TOKEN