62 lines
2 KiB
YAML
62 lines
2 KiB
YAML
|
# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
|
||
|
|
# Two railiance01-local Kubernetes-auth stores for the KeyCape verifier copies of
|
||
|
|
# the approval-engine confidential client secrets. Deliberately separate stores,
|
||
|
|
# roles and policies so either client can be revoked without disturbing the other;
|
||
|
|
# their scope sets differ and a shared identity would erase that boundary.
|
||
|
|
#
|
||
|
|
# Do not apply before both CCRs are approved and the exact-path policies and
|
||
|
|
# Kubernetes auth roles exist. Both stores are limited to namespace sso and grant
|
||
|
|
# no access to any other platform workload path.
|
||
|
|
#
|
||
|
|
# The existing sso Secret keycape-rapp-qonto-client is hand-created, not managed
|
||
|
|
# here; adopting it is a separate migration.
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
metadata:
|
||
|
|
name: openbao-keycape-secrets-engine-approval
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: railiance-gitops
|
||
|
|
railiance-platform/component: external-secrets
|
||
|
|
app.kubernetes.io/name: keycape
|
||
|
|
spec:
|
||
|
|
provider:
|
||
|
|
vault:
|
||
|
|
server: http://openbao.openbao.svc:8200
|
||
|
|
path: platform
|
||
|
|
version: v2
|
||
|
|
auth:
|
||
|
|
kubernetes:
|
||
|
|
mountPath: kubernetes
|
||
|
|
role: external-secrets-keycape-secrets-engine-approval
|
||
|
|
serviceAccountRef:
|
||
|
|
name: external-secrets
|
||
|
|
namespace: external-secrets
|
||
|
|
conditions:
|
||
|
|
- namespaces:
|
||
|
|
- sso
|
||
|
|
---
|
||
|
|
apiVersion: external-secrets.io/v1
|
||
|
|
kind: ClusterSecretStore
|
||
|
|
metadata:
|
||
|
|
name: openbao-keycape-approval-engine-operator
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/part-of: railiance-gitops
|
||
|
|
railiance-platform/component: external-secrets
|
||
|
|
app.kubernetes.io/name: keycape
|
||
|
|
spec:
|
||
|
|
provider:
|
||
|
|
vault:
|
||
|
|
server: http://openbao.openbao.svc:8200
|
||
|
|
path: platform
|
||
|
|
version: v2
|
||
|
|
auth:
|
||
|
|
kubernetes:
|
||
|
|
mountPath: kubernetes
|
||
|
|
role: external-secrets-keycape-approval-engine-operator
|
||
|
|
serviceAccountRef:
|
||
|
|
name: external-secrets
|
||
|
|
namespace: external-secrets
|
||
|
|
conditions:
|
||
|
|
- namespaces:
|
||
|
|
- sso
|