b2ebe10849
The five dynamic-database ClusterSecretStores use 768h static tokens that nothing renews; expiry revoked their DB leases on 2026-09-23 and recurs around 2026-10-25. Kubernetes auth is not a drop-in fix: ESO v0.16.1 revokes its login token after each reconcile, which revokes the leases it created. - eso-token-renewer CronJob (ArgoCD draft, no RBAC, mounted Secrets). - Attended periodic mint script for all five lanes. - CronJob added to the platform-addons AppProject in git (not yet applied). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: railiance-platform-addons
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/part-of: railiance-gitops
|
|
railiance-platform/component: gitops
|
|
spec:
|
|
description: Platform-owned cluster add-ons required by tenant workloads.
|
|
sourceRepos:
|
|
- https://forgejo.coulomb.social/coulomb/railiance-platform.git
|
|
- https://charts.external-secrets.io
|
|
destinations:
|
|
- server: https://kubernetes.default.svc
|
|
namespace: "*"
|
|
clusterResourceWhitelist:
|
|
- group: ""
|
|
kind: Namespace
|
|
- group: apiextensions.k8s.io
|
|
kind: CustomResourceDefinition
|
|
- group: admissionregistration.k8s.io
|
|
kind: MutatingWebhookConfiguration
|
|
- group: admissionregistration.k8s.io
|
|
kind: ValidatingWebhookConfiguration
|
|
- group: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
- group: rbac.authorization.k8s.io
|
|
kind: ClusterRoleBinding
|
|
- group: external-secrets.io
|
|
kind: ClusterSecretStore
|
|
namespaceResourceWhitelist:
|
|
- group: ""
|
|
kind: ConfigMap
|
|
- group: ""
|
|
kind: Secret
|
|
- group: ""
|
|
kind: Service
|
|
- group: ""
|
|
kind: ServiceAccount
|
|
- group: apps
|
|
kind: Deployment
|
|
- group: batch
|
|
kind: CronJob
|
|
- group: rbac.authorization.k8s.io
|
|
kind: Role
|
|
- group: rbac.authorization.k8s.io
|
|
kind: RoleBinding
|
|
orphanedResources:
|
|
warn: true
|