From 741f209e339d3b0ed4dc613dda8cc2bcc3814816 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 3 Aug 2026 21:36:52 +0200 Subject: [PATCH] Move platform secret stores to local OpenBao --- .../openbao-activity-core.clustersecretstore.yaml | 10 ++++------ .../openbao-forgejo.clustersecretstore.yaml | 7 +++---- .../openbao-rapp-qonto.clustersecretstore.yaml | 9 ++++----- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml index 144c818..b25fcc4 100644 --- a/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml +++ b/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml @@ -1,7 +1,5 @@ -# Interim: activity-core on railiance01 reads runtime secrets from coulombcore -# OpenBao (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped -# (Wave 7). Target state uses in-cluster OpenBao + Kubernetes auth role -# external-secrets-activity-core. +# activity-core reads runtime secrets from the private railiance01 OpenBao +# service. Kubernetes auth remains the preferred follow-up identity. # # Prereq: Secret external-secrets/openbao-activity-core-eso-token (key: token) # with a policy-limited OpenBao token that can read @@ -17,7 +15,7 @@ metadata: spec: provider: vault: - server: https://bao.coulomb.social + server: http://openbao.openbao.svc:8200 path: platform version: v2 auth: @@ -27,4 +25,4 @@ spec: key: token conditions: - namespaces: - - activity-core \ No newline at end of file + - activity-core diff --git a/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml index e6634e8..bccd870 100644 --- a/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml +++ b/argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml @@ -1,5 +1,4 @@ -# Interim: Forgejo on railiance01 reads SMTP creds from coulombcore OpenBao -# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7). +# Forgejo reads SMTP credentials from the private railiance01 OpenBao service. # # Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a # policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer. @@ -14,7 +13,7 @@ metadata: spec: provider: vault: - server: https://bao.coulomb.social + server: http://openbao.openbao.svc:8200 path: platform version: v2 auth: @@ -24,4 +23,4 @@ spec: key: token conditions: - namespaces: - - forgejo \ No newline at end of file + - forgejo diff --git a/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml index 9f0360c..b1f7734 100644 --- a/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml +++ b/argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml @@ -1,7 +1,6 @@ -# Transitional cross-cluster bridge: the credential remains in Coulombcore -# OpenBao while rapp-qonto runs on railiance01. ESO uses a dedicated AppRole -# to mint short-lived tokens; replace this with same-cluster Kubernetes auth -# when secret custody and workload placement are unified. +# rapp-qonto uses the private railiance01 OpenBao service. ESO retains the +# dedicated AppRole during the endpoint cutover; same-cluster Kubernetes auth +# is the follow-up steady-state identity. # # Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys # role-id and secret-id, delivered by the approved ops-mason construction plan. @@ -15,7 +14,7 @@ metadata: spec: provider: vault: - server: https://bao.coulomb.social + server: http://openbao.openbao.svc:8200 path: tenants version: v2 auth: