# Bounded executor credential delivery (NK-WP-0056-T06; RPF-WP-0069-T05/T09).
# Apply only after CCR-2026-0060 and CCR-2026-0063 are approved and applied and both custody
# entries exist (docs/credential-lane-designs/nk-bind-executor-go-live.md). No value is in this file.
#
# 1. KeyCape's copy of the nk-bind-executor-approval client secret (CCR-2026-0060), rendered from
#    manifests/templates/keycape-issuer-eso.yaml for client_id nk-bind-executor-approval.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-keycape-nk-bind-executor-approval-issuer
  annotations:
    railiance.io/credential-change: CCR-2026-0060
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-keycape-nk-bind-executor-approval
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
            audiences:
              - openbao
  conditions:
    - namespaces:
        - sso
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycape-nk-bind-executor-approval-client
  namespace: sso
  annotations:
    railiance.io/credential-change: CCR-2026-0060
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-keycape-nk-bind-executor-approval-issuer
  target:
    name: keycape-nk-bind-executor-approval-client
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: client-secret
      remoteRef:
        key: workloads/keycape/nk-bind-executor-approval
        property: CLIENT_SECRET
---
# 2. The executor's audit-core sender bearer (CCR-2026-0063). Secret name and key are the ones the
#    rapp-bounded-executor run Job mounts (/var/run/secrets/bounded-executor/audit-core).
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-nk-bind-executor-audit
  annotations:
    railiance.io/credential-change: CCR-2026-0063
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-nk-bind-executor-audit
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
            audiences:
              - openbao
  conditions:
    - namespaces:
        - sso
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: bounded-executor-tokens
  namespace: sso
  annotations:
    railiance.io/credential-change: CCR-2026-0063
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-nk-bind-executor-audit
  target:
    name: bounded-executor-tokens
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: audit-core
      remoteRef:
        key: workloads/net-kingdom/bounded-executor/audit-sender
        property: AUDIT_TOKEN