tegwick
11f689d86d
MASON-WP-0003-T02 delivered the token on 2026-08-27, and three of its details differ from the chart's placeholders: KV v2 puts `data/` in the read path, the field is `FORGE_READ_TOKEN` rather than `token`, and the address matches every existing ClusterSecretStore (`http://openbao.openbao.svc:8200`, mount `platform`, auth mount `kubernetes`). The projected token's audience is now optional and defaults to empty. A token carrying an audience the auth role does not bind is rejected at TokenReview, and the role's audience binding is not readable without a privileged session — the four existing external-secrets roles use the API server audience, so that is the default that can be verified to work. Setting `openbao` here narrows the token to OpenBao alone and is worth doing once the role binds it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 |
||
|---|---|---|
| .. | ||
| files | ||
| templates | ||
| Chart.yaml | ||
| PROMOTE.md | ||
| values.yaml | ||