tegwick
63818fe498
QONTO-WP-0004-T06. Requests a second, workload-scoped access lane into the existing tenants/binky/qonto-api credential (CCR-2026-0008 is human/OIDC admin access only, not usable by a running pod). Mirrors CCR-2026-0003's llm-connect pattern: External Secrets Operator reads the KV path into a namespace-scoped Kubernetes Secret via a ClusterSecretStore restricted to the new qonto-assistant namespace; the pod never touches the OpenBao token directly. Status: proposed, not approved -- requires platform-operator and binky-tenant-owner sign-off before the auth role/policy are applied. Draft ClusterSecretStore manifest included, following the same "deployed separately, not via this kustomization" pattern as the existing activity-core/forgejo/reuse stores. Validated against schemas/credential-change-request.schema.yaml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
# DRAFT -- proposed alongside CCR-2026-0009 (status: proposed, not yet
|
|
# approved). Do not apply until CCR-2026-0009 is approved and the underlying
|
|
# OpenBao policy + Kubernetes auth role exist.
|
|
#
|
|
# Mirrors openbao-activity-core.clustersecretstore.yaml's interim pattern:
|
|
# reads from coulombcore OpenBao (https://bao.coulomb.social) via a
|
|
# policy-limited token until railiance01 OpenBao is bootstrapped and a real
|
|
# Kubernetes auth role (external-secrets-qonto-assistant, CCR-2026-0009) is
|
|
# live. Scoped to the tenants mount (matches CCR-2026-0008's mount, not
|
|
# CCR-2026-0003's platform mount) and restricted to the qonto-assistant
|
|
# namespace only via `conditions`.
|
|
#
|
|
# Prereq: Secret external-secrets/openbao-qonto-assistant-eso-token (key:
|
|
# token) with a policy-limited OpenBao token that can read
|
|
# tenants/binky/qonto-api (API_KEY, API_USER) -- see CCR-2026-0009.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-qonto-assistant
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: external-secrets
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: https://bao.coulomb.social
|
|
path: tenants
|
|
version: v2
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-qonto-assistant-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
conditions:
|
|
- namespaces:
|
|
- qonto-assistant
|