Move platform secret stores to local OpenBao

argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml

@@ -1,7 +1,5 @@
-# Interim: activity-core on railiance01 reads runtime secrets from coulombcore
-# OpenBao (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped
-# (Wave 7). Target state uses in-cluster OpenBao + Kubernetes auth role
-# external-secrets-activity-core.
+# activity-core reads runtime secrets from the private railiance01 OpenBao
+# service. Kubernetes auth remains the preferred follow-up identity.
 #
 # Prereq: Secret external-secrets/openbao-activity-core-eso-token (key: token)
 # with a policy-limited OpenBao token that can read
@@ -17,7 +15,7 @@ metadata:
 spec:
   provider:
     vault:
-      server: https://bao.coulomb.social
+      server: http://openbao.openbao.svc:8200
       path: platform
       version: v2
       auth:
@@ -27,4 +25,4 @@ spec:
           key: token
   conditions:
     - namespaces:
-        - activity-core
+        - activity-core

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -1,5 +1,4 @@
-# Interim: Forgejo on railiance01 reads SMTP creds from coulombcore OpenBao
-# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
+# Forgejo reads SMTP credentials from the private railiance01 OpenBao service.
 #
 # Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
 # policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
@@ -14,7 +13,7 @@ metadata:
 spec:
   provider:
     vault:
-      server: https://bao.coulomb.social
+      server: http://openbao.openbao.svc:8200
       path: platform
       version: v2
       auth:
@@ -24,4 +23,4 @@ spec:
           key: token
   conditions:
     - namespaces:
-        - forgejo
+        - forgejo

argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml

@@ -1,7 +1,6 @@
-# Transitional cross-cluster bridge: the credential remains in Coulombcore
-# OpenBao while rapp-qonto runs on railiance01. ESO uses a dedicated AppRole
-# to mint short-lived tokens; replace this with same-cluster Kubernetes auth
-# when secret custody and workload placement are unified.
+# rapp-qonto uses the private railiance01 OpenBao service. ESO retains the
+# dedicated AppRole during the endpoint cutover; same-cluster Kubernetes auth
+# is the follow-up steady-state identity.
 #
 # Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys
 # role-id and secret-id, delivered by the approved ops-mason construction plan.
@@ -15,7 +14,7 @@ metadata:
 spec:
   provider:
     vault:
-      server: https://bao.coulomb.social
+      server: http://openbao.openbao.svc:8200
       path: tenants
       version: v2
       auth: