apiVersion: v1
kind: ServiceAccount
metadata:
  name: informed-decision-eso
  namespace: informed-decision
  annotations:
    railiance.io/credential-change: CCR-2026-0032
    railiance.io/admission: approved-CCR-2026-0032
automountServiceAccountToken: false
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-informed-decision-sitting-requester
  annotations:
    railiance.io/credential-change: CCR-2026-0032
    railiance.io/admission: approved-CCR-2026-0032
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: informed-decision-sitting-requester-eso
          serviceAccountRef:
            name: informed-decision-eso
            namespace: informed-decision
            audiences:
            - openbao
  conditions:
  - namespaces:
    - informed-decision
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: informed-decision-sitting-requester
  namespace: informed-decision
  annotations:
    railiance.io/credential-change: CCR-2026-0032
    railiance.io/admission: approved-CCR-2026-0032
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-informed-decision-sitting-requester
  target:
    name: informed-decision-sitting-requester
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      metadata:
        annotations:
          railiance.io/credential-change: CCR-2026-0032
          railiance.io/admission: approved-CCR-2026-0032
  data:
  - secretKey: client-secret
    remoteRef:
      key: workloads/informed-decision/sitting-requester
      property: CLIENT_SECRET