# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
# Two railiance01-local Kubernetes-auth stores for the KeyCape verifier copies of
# the approval-engine confidential client secrets. Deliberately separate stores,
# roles and policies so either client can be revoked without disturbing the other;
# their scope sets differ and a shared identity would erase that boundary.
#
# Do not apply before both CCRs are approved and the exact-path policies and
# Kubernetes auth roles exist. Both stores are limited to namespace sso and grant
# no access to any other platform workload path.
#
# The existing sso Secret keycape-rapp-qonto-client is hand-created, not managed
# here; adopting it is a separate migration.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-keycape-secrets-engine-approval
  labels:
    app.kubernetes.io/part-of: railiance-gitops
    railiance-platform/component: external-secrets
    app.kubernetes.io/name: keycape
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-keycape-secrets-engine-approval
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
    - namespaces:
        - sso
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-keycape-approval-engine-operator
  labels:
    app.kubernetes.io/part-of: railiance-gitops
    railiance-platform/component: external-secrets
    app.kubernetes.io/name: keycape
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-keycape-approval-engine-operator
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
    - namespaces:
        - sso