# The OpenBao-backed ESO store. The server URL, the vault CA and the client-certificate Secret
# name/namespace are PLACEHOLDERS here on purpose: internal/eso rewrites them from the cluster's
# own values before applying. They are set to values that are visible-wrong rather than plausible
# so that applying this file by hand against a real tenant cluster fails at the vault connection
# instead of silently trusting the wrong server.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao
spec:
  provider:
    vault:
      # Rewritten by internal/esovault to https://127.0.0.1:<leased vault port>: the controller is a
      # process beside the control plane, so the vault it dials is the loopback listener.
      server: "https://127.0.0.1:8200"
      path: "secret"
      version: "v2"
      # Rewritten by internal/eso to the base64 of the vault's TLS server CA (deploy tree).
      caBundle: "cGxhY2Vob2xkZXI="
      auth:
        # CERT auth: the certificate is presented in the TLS handshake and the vault binds it to
        # exactly the secret paths the eso-openbao-read policy grants. There is no token, no
        # AppRole SecretID and no Kubernetes service-account token to leak.
        cert:
          clientCert:
            name: openbao-eso-client-cert
            namespace: default
            key: tls.crt
          secretRef:
            name: openbao-eso-client-cert
            namespace: default
            key: tls.key