# target-revenue Trust Service runtime secrets on railiance01 (WP-0011).
# Pattern matches openbao-reuse / openbao-activity-core: token auth to the
# in-cluster OpenBao service, store limited to the target-revenue namespace.
#
# Prereq: Secret external-secrets/openbao-target-revenue-eso-token (key: token)
# Bootstrap: target-revenue scripts/openbao-eso-token-apply.sh
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: openbao-target-revenue
  labels:
    app.kubernetes.io/part-of: railiance-gitops
    railiance-platform/component: external-secrets
    railiance.io/domain: target-revenue
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        tokenSecretRef:
          name: openbao-target-revenue-eso-token
          namespace: external-secrets
          key: token
  conditions:
    - namespaces:
        - target-revenue