49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
|
# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
|
||
|
|
# KeyCape-side delivery of the two approval-engine confidential client secrets.
|
||
|
|
# The Kubernetes Secret key stays client-secret to match the live
|
||
|
|
# KEYCAPE_RAPP_QONTO_CLIENT_SECRET secretKeyRef shape; the OpenBao field is
|
||
|
|
# CLIENT_SECRET because KV field names are uppercase by platform convention.
|
||
|
|
#
|
||
|
|
# Apply only after the stores sync and inside the agreed attended rollout window;
|
||
|
|
# the KeyCape image that reads both environment names rolls out after these sync.
|
||
|
|
---
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ExternalSecret
|
||
|
|
metadata:
|
||
|
|
name: keycape-secrets-engine-approval-client
|
||
|
|
namespace: sso
|
||
|
|
spec:
|
||
|
|
refreshInterval: 5m
|
||
|
|
secretStoreRef:
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
name: openbao-keycape-secrets-engine-approval
|
||
|
|
target:
|
||
|
|
name: keycape-secrets-engine-approval-client
|
||
|
|
creationPolicy: Owner
|
||
|
|
deletionPolicy: Retain
|
||
|
|
data:
|
||
|
|
- secretKey: client-secret
|
||
|
|
remoteRef:
|
||
|
|
key: workloads/secrets-engine/approval-client
|
||
|
|
property: CLIENT_SECRET
|
||
|
|
---
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ExternalSecret
|
||
|
|
metadata:
|
||
|
|
name: keycape-approval-engine-operator-client
|
||
|
|
namespace: sso
|
||
|
|
spec:
|
||
|
|
refreshInterval: 5m
|
||
|
|
secretStoreRef:
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
name: openbao-keycape-approval-engine-operator
|
||
|
|
target:
|
||
|
|
name: keycape-approval-engine-operator-client
|
||
|
|
creationPolicy: Owner
|
||
|
|
deletionPolicy: Retain
|
||
|
|
data:
|
||
|
|
- secretKey: client-secret
|
||
|
|
remoteRef:
|
||
|
|
key: workloads/approval-engine/operator-client
|
||
|
|
property: CLIENT_SECRET
|