# Ephemeral, exact-path projection for WH-ENG-20260822-AUDIT-E2-02.
# Apply only through scripts/audit-core-whitehat-e2-credentials-02.py during
# the approved window. No value is present in this file.
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-whitehat-audit-e2-02
  labels:
    app.kubernetes.io/part-of: railiance-platform
    railiance-platform/engagement: WH-ENG-20260822-AUDIT-E2-02
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-whitehat-audit-e2-02
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
    - namespaces:
        - whitehat
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: whitehat-e2-audit-credentials
  namespace: whitehat
  labels:
    app.kubernetes.io/part-of: railiance-platform
    railiance-platform/engagement: WH-ENG-20260822-AUDIT-E2-02
spec:
  refreshInterval: 1m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-whitehat-audit-e2-02
  target:
    name: whitehat-e2-audit-credentials
    creationPolicy: Owner
    deletionPolicy: Delete
  data:
    - secretKey: token-a
      remoteRef:
        key: engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-a
        property: token
    - secretKey: token-b
      remoteRef:
        key: engagements/WH-ENG-20260822-AUDIT-E2-02/audit-core/token-b
        property: token