Advance RPF-WP-0021 platform onboarding

argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml

@@ -0,0 +1,60 @@
+# RPF-WP-0021: three disjoint materialized Secrets for the Core Hub package.
+# Apply only after the static CCR is approved/seeded and the database roles
+# plus exact-scope renewable ESO token exist.
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: core-hub-api-token
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-runtime
+  target:
+    name: core-hub-api-token
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: CORE_HUB_API_TOKEN
+      remoteRef:
+        key: workloads/core-hub/runtime
+        property: CORE_HUB_API_TOKEN
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: core-hub-runtime-database
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-database
+  target:
+    name: core-hub-runtime-database
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  # A single extract mints one lease and keeps its username/password paired.
+  dataFrom:
+    - extract:
+        key: creds/core-hub-runtime
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: core-hub-migration-database
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-database
+  target:
+    name: core-hub-migration-database
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  dataFrom:
+    - extract:
+        key: creds/core-hub-migration

argocd/platform-addons/openbao-secretstore/openbao-core-hub-database.clustersecretstore.yaml

@@ -0,0 +1,25 @@
+# Railiance01-local database-engine store for RPF-WP-0021. The renewable
+# orphan parent token is streamed into the referenced Secret by an attended
+# platform operation; its value never enters this repository.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-core-hub-database
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: core-hub
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: database
+      version: v1
+      auth:
+        tokenSecretRef:
+          name: openbao-core-hub-eso-token
+          namespace: external-secrets
+          key: token
+  conditions:
+    - namespaces:
+        - core-hub