b2ebe10849
The five dynamic-database ClusterSecretStores use 768h static tokens that nothing renews; expiry revoked their DB leases on 2026-09-23 and recurs around 2026-10-25. Kubernetes auth is not a drop-in fix: ESO v0.16.1 revokes its login token after each reconcile, which revokes the leases it created. - eso-token-renewer CronJob (ArgoCD draft, no RBAC, mounted Secrets). - Attended periodic mint script for all five lanes. - CronJob added to the platform-addons AppProject in git (not yet applied). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
27 lines
948 B
YAML
27 lines
948 B
YAML
# DRAFT for railiance01 (RPF-WP-0046-T04). Not synced by any root: move to
|
|
# ../applications/ only in T04, with the founder's go-ahead, after the
|
|
# platform-addons AppProject carries batch/CronJob. No automated sync, no
|
|
# finalizer. Set targetRevision to the reviewed commit at adoption.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: eso-token-renewer
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: external-secrets
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
spec:
|
|
project: railiance-platform-addons
|
|
source:
|
|
repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
|
|
targetRevision: PIN-AT-ADOPTION
|
|
path: argocd/platform-addons/eso-token-renewer
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: external-secrets
|
|
syncPolicy:
|
|
syncOptions:
|
|
- ApplyOutOfSyncOnly=true
|
|
- PruneLast=true
|