tegwick
9e4e84f9ee
Record T01 package (in-repo k8s/railiance, combined /ui + API app, dedicated CNPG). Add Dockerfile, healthz, migration/bootstrap scripts, kustomize manifests, ArgoCD Application (in railiance-platform), and docs/deployment.md. T05 left open for operator DNS/OpenBao/image push.
46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
# Runtime secrets for Trust Service + Control Plane (WP-0011).
|
|
#
|
|
# OpenBao path (platform KV v2): workloads/target-revenue/runtime-secrets
|
|
# Fields:
|
|
# TRF_SIGNING_KEY_HEX — 64 hex chars Ed25519 seed (32 bytes)
|
|
# TRF_CONTROL_PLANE_SECRET_KEY — session cookie signing secret
|
|
# TRF_DATABASE_URL — psycopg DSN for trf_app role
|
|
# TRF_MIGRATE_DATABASE_URL — DSN for trf_owner (migrate/bootstrap Jobs)
|
|
#
|
|
# Pre-reqs: ESO + ClusterSecretStore openbao (railiance-platform);
|
|
# OpenBao policy granting read of the path above.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: target-revenue-runtime
|
|
namespace: target-revenue
|
|
labels:
|
|
app.kubernetes.io/name: target-revenue
|
|
app.kubernetes.io/part-of: target-revenue
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: openbao
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: target-revenue-runtime
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: TRF_SIGNING_KEY_HEX
|
|
remoteRef:
|
|
key: workloads/target-revenue/runtime-secrets
|
|
property: TRF_SIGNING_KEY_HEX
|
|
- secretKey: TRF_CONTROL_PLANE_SECRET_KEY
|
|
remoteRef:
|
|
key: workloads/target-revenue/runtime-secrets
|
|
property: TRF_CONTROL_PLANE_SECRET_KEY
|
|
- secretKey: TRF_DATABASE_URL
|
|
remoteRef:
|
|
key: workloads/target-revenue/runtime-secrets
|
|
property: TRF_DATABASE_URL
|
|
- secretKey: TRF_MIGRATE_DATABASE_URL
|
|
remoteRef:
|
|
key: workloads/target-revenue/runtime-secrets
|
|
property: TRF_MIGRATE_DATABASE_URL
|