Move reuse secrets to local OpenBao

argocd/platform-addons/openbao-secretstore/openbao-reuse.clustersecretstore.yaml

@@ -1,5 +1,6 @@
-# Interim: reuse-surface on railiance01 reads runtime secrets from coulombcore OpenBao
-# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
+# reuse-surface uses the private OpenBao service on railiance01. Public
+# bao.coulomb.social remains the operator/API address and is not a workload
+# runtime dependency.
 #
 # Prereq: Secret external-secrets/openbao-reuse-eso-token (key: token) with a
 # policy-limited OpenBao token that can read
@@ -15,7 +16,7 @@ metadata:
 spec:
   provider:
     vault:
-      server: https://bao.coulomb.social
+      server: http://openbao.openbao.svc:8200
       path: platform
       version: v2
       auth:
@@ -25,4 +26,4 @@ spec:
           key: token
   conditions:
     - namespaces:
-        - reuse
+        - reuse