37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
|
# DRAFT -- proposed alongside CCR-2026-0009 (status: proposed, not yet
|
||
|
|
# approved). Do not apply until CCR-2026-0009 is approved and the underlying
|
||
|
|
# OpenBao policy + Kubernetes auth role exist.
|
||
|
|
#
|
||
|
|
# Mirrors openbao-activity-core.clustersecretstore.yaml's interim pattern:
|
||
|
|
# reads from coulombcore OpenBao (https://bao.coulomb.social) via a
|
||
|
|
# policy-limited token until railiance01 OpenBao is bootstrapped and a real
|
||
|
|
# Kubernetes auth role (external-secrets-qonto-assistant, CCR-2026-0009) is
|
||
|
|
# live. Scoped to the tenants mount (matches CCR-2026-0008's mount, not
|
||
|
|
# CCR-2026-0003's platform mount) and restricted to the qonto-assistant
|
||
|
|
# namespace only via `conditions`.
|
||
|
|
#
|
||
|
|
# Prereq: Secret external-secrets/openbao-qonto-assistant-eso-token (key:
|
||
|
|
# token) with a policy-limited OpenBao token that can read
|
||
|
|
# tenants/binky/qonto-api (API_KEY, API_USER) -- see CCR-2026-0009.
|
||
|
|
apiVersion: external-secrets.io/v1beta1
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
metadata:
|
||
|
|
name: openbao-qonto-assistant
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: railiance-gitops
|
||
|
|
railiance-platform/component: external-secrets
|
||
|
|
spec:
|
||
|
|
provider:
|
||
|
|
vault:
|
||
|
|
server: https://bao.coulomb.social
|
||
|
|
path: tenants
|
||
|
|
version: v2
|
||
|
|
auth:
|
||
|
|
tokenSecretRef:
|
||
|
|
name: openbao-qonto-assistant-eso-token
|
||
|
|
namespace: external-secrets
|
||
|
|
key: token
|
||
|
|
conditions:
|
||
|
|
- namespaces:
|
||
|
|
- qonto-assistant
|