1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# The OpenBao-backed ESO store. The server URL, the vault CA and the client-certificate Secret
# name/namespace are PLACEHOLDERS here on purpose: internal/eso rewrites them from the cluster's
# own values before applying. They are set to values that are visible-wrong rather than plausible
# so that applying this file by hand against a real tenant cluster fails at the vault connection
# instead of silently trusting the wrong server.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: openbao
spec:
provider:
vault:
# Rewritten by internal/esovault to https://127.0.0.1:<leased vault port>: the controller is a
# process beside the control plane, so the vault it dials is the loopback listener.
server: "https://127.0.0.1:8200"
path: "secret"
version: "v2"
# Rewritten by internal/eso to the base64 of the vault's TLS server CA (deploy tree).
caBundle: "cGxhY2Vob2xkZXI="
auth:
# CERT auth: the certificate is presented in the TLS handshake and the vault binds it to
# exactly the secret paths the eso-openbao-read policy grants. There is no token, no
# AppRole SecretID and no Kubernetes service-account token to leak.
cert:
clientCert:
name: openbao-eso-client-cert
namespace: default
key: tls.crt
secretRef:
name: openbao-eso-client-cert
namespace: default
key: tls.key
