Prepare bounded Kubernetes authentication recovery for three ESO lanes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -1,8 +1,4 @@
-# Forgejo reads SMTP credentials from the private railiance01 OpenBao service.
-#
-# Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
-# policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
-# Bootstrap: railiance-apps make forgejo-openbao-eso-token-apply
+# RPF-WP-0037: exact namespace/SA/audience Kubernetes auth; no static token.
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -17,10 +13,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-forgejo-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: forgejo-mailer-eso
+          serviceAccountRef:
+            name: forgejo-mailer-eso
+            namespace: forgejo
+            audiences:
+            - openbao
   conditions:
-    - namespaces:
-        - forgejo
+  - namespaces:
+    - forgejo

argocd/platform-addons/openbao-secretstore/openbao-reuse.clustersecretstore.yaml

@@ -1,11 +1,4 @@
-# reuse-surface uses the private OpenBao service on railiance01. Public
-# bao.coulomb.social remains the operator/API address and is not a workload
-# runtime dependency.
-#
-# Prereq: Secret external-secrets/openbao-reuse-eso-token (key: token) with a
-# policy-limited OpenBao token that can read
-# platform/workloads/reuse/reuse-surface/runtime-secrets.
-# Bootstrap: railiance-apps make reuse-openbao-eso-token-apply
+# RPF-WP-0037: exact namespace/SA/audience Kubernetes auth; no static token.
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -20,10 +13,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-reuse-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: reuse-surface-runtime-eso
+          serviceAccountRef:
+            name: reuse-surface-eso
+            namespace: reuse
+            audiences:
+            - openbao
   conditions:
-    - namespaces:
-        - reuse
+  - namespaces:
+    - reuse

argocd/platform-addons/openbao-secretstore/openbao-target-revenue.clustersecretstore.yaml

@@ -1,9 +1,4 @@
-# target-revenue Trust Service runtime secrets on railiance01 (WP-0011).
-# Pattern matches openbao-reuse / openbao-activity-core: token auth to the
-# in-cluster OpenBao service, store limited to the target-revenue namespace.
-#
-# Prereq: Secret external-secrets/openbao-target-revenue-eso-token (key: token)
-# Bootstrap: target-revenue scripts/openbao-eso-token-apply.sh
+# RPF-WP-0037: exact namespace/SA/audience Kubernetes auth; no static token.
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -19,10 +14,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-target-revenue-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: target-revenue-runtime-eso
+          serviceAccountRef:
+            name: target-revenue-eso
+            namespace: target-revenue
+            audiences:
+            - openbao
   conditions:
-    - namespaces:
-        - target-revenue
+  - namespaces:
+    - target-revenue