From 6abf6b56a09b264a533920deeab1c398cfbd80e3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 8 Jul 2026 15:41:04 +0200 Subject: [PATCH] Fix openbao-secretstore ArgoCD health: coulombcore scope only Remove interim ClusterSecretStores (forgejo, activity-core, reuse) from coulombcore ArgoCD kustomization. Those stores target railiance01 namespaces and are bootstrapped via railiance-apps/activity-core Make targets. --- .../openbao-secretstore/kustomization.yaml | 8 +++--- docs/argocd-gitops.md | 26 +++++++++++++------ 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/argocd/platform-addons/openbao-secretstore/kustomization.yaml b/argocd/platform-addons/openbao-secretstore/kustomization.yaml index f20b76d..cc7fbda 100644 --- a/argocd/platform-addons/openbao-secretstore/kustomization.yaml +++ b/argocd/platform-addons/openbao-secretstore/kustomization.yaml @@ -1,8 +1,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +# Coulombcore ArgoCD scope: in-cluster OpenBao only (issue-core Kubernetes auth). +# Interim cross-cluster stores (openbao-forgejo, openbao-activity-core, openbao-reuse) +# target railiance01 namespaces — deploy via railiance-apps / activity-core Make +# targets, not this kustomization. See docs/argocd-gitops.md § Platform add-ons. + resources: - openbao.clustersecretstore.yaml - - openbao-activity-core.clustersecretstore.yaml - - openbao-forgejo.clustersecretstore.yaml - - openbao-reuse.clustersecretstore.yaml diff --git a/docs/argocd-gitops.md b/docs/argocd-gitops.md index 3eb7aee..e9312e7 100644 --- a/docs/argocd-gitops.md +++ b/docs/argocd-gitops.md @@ -188,17 +188,27 @@ The GitOps contract uses: - `railiance-platform-addons` AppProject for cluster add-ons. - `external-secrets` ArgoCD Application for the public Helm chart. -- `openbao-secretstore` ArgoCD Application for the OpenBao - `ClusterSecretStore`. +- `openbao-secretstore` ArgoCD Application for the in-cluster OpenBao + `ClusterSecretStore` on coulombcore (`openbao` only). - OpenBao Kubernetes auth role `external-secrets-issue-core` for the issue-core pilot. -- OpenBao Kubernetes auth role `external-secrets-activity-core` for the - activity-core/llm-connect provider-secret lane once approved. -`ClusterSecretStore/openbao` is limited to the `issue-core` namespace. -`ClusterSecretStore/openbao-activity-core` is limited to the `activity-core` -namespace and is intended for the llm-connect provider-secret lane. Broaden or -add stores only with platform review. +`ClusterSecretStore/openbao` is limited to the `issue-core` namespace on +coulombcore. + +**Railiance01 interim stores** (read coulombcore OpenBao at +`https://bao.coulomb.social` until Wave 7) are **not** managed by coulombcore +ArgoCD. Apply per workload: + +| Store | Bootstrap | +| --- | --- | +| `openbao-forgejo` | `railiance-apps` `make forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy` | +| `openbao-activity-core` | `activity-core` `make openbao-eso-token-apply` + `kubectl apply -f …/openbao-activity-core.clustersecretstore.yaml` | +| `openbao-reuse` | `railiance-apps` `make reuse-openbao-eso-token-apply reuse-openbao-store-deploy` | + +Manifests live under `argocd/platform-addons/openbao-secretstore/` but are +excluded from the coulombcore kustomization. Broaden or add stores only with +platform review. Configure the OpenBao side without printing token values: