Point openbao-audit-core store at the Mason AppRole

argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml

@@ -2,13 +2,10 @@
 # coulombcore ArgoCD kustomization — same interim pattern as
 # openbao-email-connect / openbao-activity-core).
 #
-# Prereq: Secret external-secrets/openbao-audit-core-eso-token (key: token)
-# with policy external-secrets-audit-core. Bootstrap:
-#   audit-core/scripts/openbao-eso-token-apply.sh
-#
-# Database leases are *not* served by this store. They are OpenBao database
-# engine credentials and are vended by VaultDynamicSecret in the audit-core
-# package (deploy/vaultdynamicsecrets.yaml).
+# Prereq: Secret external-secrets/openbao-audit-core-approle (role-id, secret-id)
+# delivered by ops-mason plan audit-core-openbao-runtime-custody.
+# Database leases use sibling store openbao-audit-core-database in the
+# audit-core package (same AppRole, database mount).
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
@@ -24,10 +21,16 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-audit-core-eso-token
-          namespace: external-secrets
-          key: token
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-audit-core-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-audit-core-approle
+            namespace: external-secrets
+            key: secret-id
   conditions:
     - namespaces:
         - audit-core