From 32ccc8307690d620f20abb5d2d14b8f4da81d424 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 27 Jul 2026 03:14:07 +0200
Subject: [PATCH] Add AppRole-backed Qonto secret store

---
 ...ao-qonto-assistant.clustersecretstore.yaml | 36 -------------------
 ...openbao-rapp-qonto.clustersecretstore.yaml | 34 ++++++++++++++++++
 2 files changed, 34 insertions(+), 36 deletions(-)
 delete mode 100644 argocd/platform-addons/openbao-secretstore/openbao-qonto-assistant.clustersecretstore.yaml
 create mode 100644 argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml

diff --git a/argocd/platform-addons/openbao-secretstore/openbao-qonto-assistant.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-qonto-assistant.clustersecretstore.yaml
deleted file mode 100644
index c556fba..0000000
--- a/argocd/platform-addons/openbao-secretstore/openbao-qonto-assistant.clustersecretstore.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-# DRAFT -- proposed alongside CCR-2026-0009 (status: proposed, not yet
-# approved). Do not apply until CCR-2026-0009 is approved and the underlying
-# OpenBao policy + Kubernetes auth role exist.
-#
-# Mirrors openbao-activity-core.clustersecretstore.yaml's interim pattern:
-# reads from coulombcore OpenBao (https://bao.coulomb.social) via a
-# policy-limited token until railiance01 OpenBao is bootstrapped and a real
-# Kubernetes auth role (external-secrets-qonto-assistant, CCR-2026-0009) is
-# live. Scoped to the tenants mount (matches CCR-2026-0008's mount, not
-# CCR-2026-0003's platform mount) and restricted to the qonto-assistant
-# namespace only via `conditions`.
-#
-# Prereq: Secret external-secrets/openbao-qonto-assistant-eso-token (key:
-# token) with a policy-limited OpenBao token that can read
-# tenants/binky/qonto-api (API_KEY, API_USER) -- see CCR-2026-0009.
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  name: openbao-qonto-assistant
-  labels:
-    app.kubernetes.io/part-of: railiance-gitops
-    railiance-platform/component: external-secrets
-spec:
-  provider:
-    vault:
-      server: https://bao.coulomb.social
-      path: tenants
-      version: v2
-      auth:
-        tokenSecretRef:
-          name: openbao-qonto-assistant-eso-token
-          namespace: external-secrets
-          key: token
-  conditions:
-    - namespaces:
-        - qonto-assistant
diff --git a/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml
new file mode 100644
index 0000000..9f0360c
--- /dev/null
+++ b/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml
@@ -0,0 +1,34 @@
+# Transitional cross-cluster bridge: the credential remains in Coulombcore
+# OpenBao while rapp-qonto runs on railiance01. ESO uses a dedicated AppRole
+# to mint short-lived tokens; replace this with same-cluster Kubernetes auth
+# when secret custody and workload placement are unified.
+#
+# Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys
+# role-id and secret-id, delivered by the approved ops-mason construction plan.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-rapp-qonto
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: tenants
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-rapp-qonto-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-rapp-qonto-approle
+            namespace: external-secrets
+            key: secret-id
+  conditions:
+    - namespaces:
+        - rapp-qonto