coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move platform secret stores to local OpenBao
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-03 21:36:52 +02:00
parent 33b36e801d
commit 741f209e33
3 changed files with 11 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

8
argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml
View file

@ -1,7 +1,5 @@
# Interim: activity-core on railiance01 reads runtime secrets from coulombcore # activity-core reads runtime secrets from the private railiance01 OpenBao
# OpenBao (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped # service. Kubernetes auth remains the preferred follow-up identity.
# (Wave 7). Target state uses in-cluster OpenBao + Kubernetes auth role
# external-secrets-activity-core.
# #
# Prereq: Secret external-secrets/openbao-activity-core-eso-token (key: token) # Prereq: Secret external-secrets/openbao-activity-core-eso-token (key: token)
# with a policy-limited OpenBao token that can read # with a policy-limited OpenBao token that can read
@ -17,7 +15,7 @@ metadata:
spec: spec:
provider: provider:
vault: vault:
server: https://bao.coulomb.social server: http://openbao.openbao.svc:8200
path: platform path: platform
version: v2 version: v2
auth: auth:

5
argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml
View file

@ -1,5 +1,4 @@
# Interim: Forgejo on railiance01 reads SMTP creds from coulombcore OpenBao # Forgejo reads SMTP credentials from the private railiance01 OpenBao service.
# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
# #
# Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a # Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
# policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer. # policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
@ -14,7 +13,7 @@ metadata:
spec: spec:
provider: provider:
vault: vault:
server: https://bao.coulomb.social server: http://openbao.openbao.svc:8200
path: platform path: platform
version: v2 version: v2
auth: auth:

9
argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml
View file

@ -1,7 +1,6 @@
# Transitional cross-cluster bridge: the credential remains in Coulombcore # rapp-qonto uses the private railiance01 OpenBao service. ESO retains the
# OpenBao while rapp-qonto runs on railiance01. ESO uses a dedicated AppRole # dedicated AppRole during the endpoint cutover; same-cluster Kubernetes auth
# to mint short-lived tokens; replace this with same-cluster Kubernetes auth # is the follow-up steady-state identity.
# when secret custody and workload placement are unified.
# #
# Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys # Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys
# role-id and secret-id, delivered by the approved ops-mason construction plan. # role-id and secret-id, delivered by the approved ops-mason construction plan.
@ -15,7 +14,7 @@ metadata:
spec: spec:
provider: provider:
vault: vault:
server: https://bao.coulomb.social server: http://openbao.openbao.svc:8200
path: tenants path: tenants
version: v2 version: v2
auth: auth: