tegwick
40f0cb741d
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime ExternalSecret, ESO token bootstrap script, and Makefile targets for CCR-2026-0005 / RAILIANCE-WP-0011.
35 lines
No EOL
1.2 KiB
YAML
35 lines
No EOL
1.2 KiB
YAML
# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
|
|
#
|
|
# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
|
|
# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
#
|
|
# Prereqs on railiance01:
|
|
# - External Secrets Operator (make eso-deploy)
|
|
# - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
|
|
# - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
|
|
# (make reuse-openbao-eso-token-apply)
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: reuse-surface-runtime
|
|
namespace: reuse
|
|
labels:
|
|
app.kubernetes.io/name: reuse-surface
|
|
app.kubernetes.io/part-of: railiance-apps
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-reuse
|
|
target:
|
|
name: reuse-surface-env
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: REUSE_SURFACE_TOKEN
|
|
remoteRef:
|
|
key: workloads/reuse/reuse-surface/runtime-secrets
|
|
property: REUSE_SURFACE_TOKEN
|
|
- secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
remoteRef:
|
|
key: workloads/reuse/reuse-surface/runtime-secrets
|
|
property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET |