From deabcde73ce0b4e7b6a3399644917b411364838e Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 13 Aug 2026 10:42:59 +0200 Subject: [PATCH] Point openbao-audit-core store at the Mason AppRole --- ...openbao-audit-core.clustersecretstore.yaml | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml index aaf1c73..abda062 100644 --- a/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml +++ b/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml @@ -2,13 +2,10 @@ # coulombcore ArgoCD kustomization — same interim pattern as # openbao-email-connect / openbao-activity-core). # -# Prereq: Secret external-secrets/openbao-audit-core-eso-token (key: token) -# with policy external-secrets-audit-core. Bootstrap: -# audit-core/scripts/openbao-eso-token-apply.sh -# -# Database leases are *not* served by this store. They are OpenBao database -# engine credentials and are vended by VaultDynamicSecret in the audit-core -# package (deploy/vaultdynamicsecrets.yaml). +# Prereq: Secret external-secrets/openbao-audit-core-approle (role-id, secret-id) +# delivered by ops-mason plan audit-core-openbao-runtime-custody. +# Database leases use sibling store openbao-audit-core-database in the +# audit-core package (same AppRole, database mount). apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: @@ -24,10 +21,16 @@ spec: path: platform version: v2 auth: - tokenSecretRef: - name: openbao-audit-core-eso-token - namespace: external-secrets - key: token + appRole: + path: approle + roleRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: role-id + secretRef: + name: openbao-audit-core-approle + namespace: external-secrets + key: secret-id conditions: - namespaces: - audit-core