b2ebe10849
The five dynamic-database ClusterSecretStores use 768h static tokens that nothing renews; expiry revoked their DB leases on 2026-09-23 and recurs around 2026-10-25. Kubernetes auth is not a drop-in fix: ESO v0.16.1 revokes its login token after each reconcile, which revokes the leases it created. - eso-token-renewer CronJob (ArgoCD draft, no RBAC, mounted Secrets). - Attended periodic mint script for all five lanes. - CronJob added to the platform-addons AppProject in git (not yet applied). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
16 lines
372 B
YAML
16 lines
372 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# RPF-WP-0046. Read only by the railiance01 Application in
|
|
# argocd/railiance01/drafts/eso-token-renewer.application.yaml. No coulombcore
|
|
# Application points here.
|
|
|
|
namespace: external-secrets
|
|
|
|
resources:
|
|
- cronjob.yaml
|
|
|
|
configMapGenerator:
|
|
- name: eso-token-renewer-worker
|
|
files:
|
|
- renew.py
|