From 26dd8034107570979ade494d57dd45bee5c7370a Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 7 Oct 2026 02:05:53 +0200
Subject: [PATCH] Place the ESO audience under serviceAccountRef (ESO v1
 schema)

The server dry run rejected spec.provider.vault.auth.kubernetes.audiences. The
same audience, openbao, now sits under serviceAccountRef, as in openbao-reuse.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
---
 .../2026-10-04-1000/keycape/eso.draft.yaml                    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml b/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml
index 526a9b4..d7afc27 100644
--- a/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml
+++ b/docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml
@@ -16,11 +16,11 @@ spec:
         kubernetes:
           mountPath: kubernetes
           role: external-secrets-keycape-secrets-engine-openbao
-          audiences:
-          - openbao
           serviceAccountRef:
             name: external-secrets
             namespace: external-secrets
+            audiences:
+            - openbao
   conditions:
   - namespaces:
     - sso