coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Point openbao-audit-core store at the Mason AppRole

Browse source
This commit is contained in:
codex 2026-08-13 10:42:59 +02:00
parent cac9947e3a
commit deabcde73c
1 changed files with 14 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml
View file

@ -2,13 +2,10 @@
# coulombcore ArgoCD kustomization — same interim pattern as # coulombcore ArgoCD kustomization — same interim pattern as
# openbao-email-connect / openbao-activity-core). # openbao-email-connect / openbao-activity-core).
# #
# Prereq: Secret external-secrets/openbao-audit-core-eso-token (key: token) # Prereq: Secret external-secrets/openbao-audit-core-approle (role-id, secret-id)
# with policy external-secrets-audit-core. Bootstrap: # delivered by ops-mason plan audit-core-openbao-runtime-custody.
# audit-core/scripts/openbao-eso-token-apply.sh # Database leases use sibling store openbao-audit-core-database in the
# # audit-core package (same AppRole, database mount).
# Database leases are *not* served by this store. They are OpenBao database
# engine credentials and are vended by VaultDynamicSecret in the audit-core
# package (deploy/vaultdynamicsecrets.yaml).
apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1
kind: ClusterSecretStore kind: ClusterSecretStore
metadata: metadata:
@ -24,10 +21,16 @@ spec:
path: platform path: platform
version: v2 version: v2
auth: auth:
tokenSecretRef: appRole:
name: openbao-audit-core-eso-token path: approle
namespace: external-secrets roleRef:
key: token name: openbao-audit-core-approle
namespace: external-secrets
key: role-id
secretRef:
name: openbao-audit-core-approle
namespace: external-secrets
key: secret-id
conditions: conditions:
- namespaces: - namespaces:
- audit-core - audit-core