Initial upload

otc/ABC/stacks/ref-implementation/external-secrets/manifests/role.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: openbao
+  name: external-secrets-role
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]

otc/ABC/stacks/ref-implementation/external-secrets/manifests/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: external-secrets-rolebinding
+  namespace: openbao
+subjects:
+  - kind: ServiceAccount
+    name: external-secrets
+    namespace: external-secrets
+roleRef:
+  kind: Role
+  name: external-secrets-role
+  apiGroup: rbac.authorization.k8s.io

otc/ABC/stacks/ref-implementation/external-secrets/manifests/secret-store.yaml

@@ -0,0 +1,20 @@
+#  cluster-store.yaml 
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore #Kubernetes resource type
+metadata:
+  name: bao-backend #resource name
+  namespace: openbao
+spec:
+  provider:
+    vault: #specifies vault as the provider
+      # server: "http://10.244.0.28:8200" # how to map it dynamically?
+      server: "http://openbao.openbao.svc.cluster.local:8200"
+      path: "data" #path for accessing the secrets
+      version: "v1" #Vault API version
+      auth:
+        tokenSecretRef:
+          name: "vault-token" #Use a secret called vault-token
+          key: "token" #THIS REFERENCES THE INITIAL TOKEN NOW SAVED AS A K8 SECRET
+
+# openbao-0.openbao.pod.cluster.local
+#  10.96.59.250:8200