# The one store every namespace reads from.
#
# Cluster-scoped on purpose: authelia, gitea and cloudflared all consume it, and a
# per-namespace SecretStore would mean duplicating the OpenBao connection details
# three times.
#
# AUTH: no credential is stored anywhere. ESO presents its own ServiceAccount JWT,
# OpenBao validates it against the cluster's TokenReview API, and hands back a
# short-lived token scoped by the `external-secrets` role. The reviewer JWT that
# makes that possible lives on the bao host, configured by
# ../../infrastructure/openbao/ansible/roles/openbao_bootstrap/tasks/auth_kubernetes.yml — it is key
# material, which is why Ansible owns it and Terraform does not.
#
# TLS: bao presents a Let's Encrypt cert for bao.ad.ddupan.top, so no caBundle or
# caProvider is needed — verified from inside a pod (HTTP 200, ssl_verify_result 0).
# ⚠ Address it by HOSTNAME, never 192.168.10.8: the cert carries a DNS SAN only,
# so connecting by IP fails verification. Same trap as dc1's LDAPS cert.
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao
spec:
  provider:
    vault:
      # OpenBao is Vault-API compatible; ESO's vault provider drives it unchanged.
      server: 'https://bao.ad.ddupan.top:8200'
      # Mount path of the KV engine, from ../../infrastructure/openbao/terraform/mounts.tf.
      path: 'kv'
      version: 'v2'
      auth:
        kubernetes:
          mountPath: 'kubernetes'
          role: 'external-secrets'
          serviceAccountRef:
            name: 'external-secrets'
            # namespace is MANDATORY on a ClusterSecretStore (it has no namespace
            # of its own to resolve the reference against).
            namespace: 'external-secrets'
            # NOTE: Vault 1.21+ requires an `audiences: ['vault']` entry here, and
            # the bao role must declare a matching audience. OpenBao 2.6.1 does not,
            # so it is omitted — if auth ever starts failing with an audience
            # mismatch after an upgrade, this is the first thing to add.