# CCR-2026-0021/0022 approved 2026-09-11; no credentials or namespaces.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-approval-engine-audit
  annotations:
    railiance.io/credential-change: CCR-2026-0021
    railiance.io/admission: approved
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-approval-engine-audit
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
  - namespaces:
    - approval-engine
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: approval-engine-audit
  namespace: approval-engine
  annotations:
    railiance.io/credential-change: CCR-2026-0021
    railiance.io/admission: approved
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-approval-engine-audit
  target:
    name: approval-engine-audit
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
  - secretKey: audit-token
    remoteRef:
      key: workloads/approval-engine/audit-sender
      property: AUDIT_TOKEN
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-informed-decision-audit
  annotations:
    railiance.io/credential-change: CCR-2026-0022
    railiance.io/admission: approved
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-informed-decision-audit
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
  - namespaces:
    - informed-decision
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: informed-decision-audit
  namespace: informed-decision
  annotations:
    railiance.io/credential-change: CCR-2026-0022
    railiance.io/admission: approved
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-informed-decision-audit
  target:
    name: informed-decision-audit
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
  - secretKey: token
    remoteRef:
      key: workloads/informed-decision/audit-sender
      property: AUDIT_TOKEN