tegwick
fb7d56d3dc
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
# PROPOSAL ONLY: phase B, after hardened runtime verified and CCR approved.
|
|
# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
|
|
#
|
|
# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
|
|
# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
#
|
|
# Prereqs on railiance01:
|
|
# - External Secrets Operator (make eso-deploy)
|
|
# - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
|
|
# - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
|
|
# (make reuse-openbao-eso-token-apply)
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: reuse-surface-runtime
|
|
namespace: reuse
|
|
labels:
|
|
app.kubernetes.io/name: reuse-surface
|
|
app.kubernetes.io/part-of: railiance-apps
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-reuse
|
|
target:
|
|
# Explicit target metadata prevents ESO copying source last-applied annotations.
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: reuse-surface
|
|
app.kubernetes.io/part-of: railiance-apps
|
|
name: reuse-surface-env
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: REUSE_SURFACE_TOKEN
|
|
remoteRef:
|
|
key: workloads/reuse/reuse-surface/runtime-secrets
|
|
property: REUSE_SURFACE_TOKEN
|
|
- secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
remoteRef:
|
|
key: workloads/reuse/reuse-surface/runtime-secrets
|
|
property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
- secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN
|
|
remoteRef:
|
|
key: workloads/reuse/reuse-surface/forgejo-source-read
|
|
property: FORGEJO_SOURCE_TOKEN
|