added secret

secretstores/vault-backend.yaml

@@ -0,0 +1,30 @@
+# Points External Secrets Operator at your Vault as a secrets backend.
+# Auth is via the Kubernetes auth method (see the vault CLI commands run
+# to set this up: `vault auth enable kubernetes`, the "external-secrets"
+# role bound to the external-secrets ServiceAccount) — no long-lived Vault
+# token stored anywhere; ESO authenticates dynamically using its own
+# ServiceAccount's projected token each time it needs to read a secret.
+#
+# server uses Vault's internal cluster-DNS Service name, not the ingress
+# host — this is pod-to-pod traffic, same reasoning as claude.md's
+# "Pending" note about Jenkins pushing to Harbor via
+# harbor-core.harbor.svc.cluster.local instead of going through Contour.
+# tls_disable is set in Vault's own listener config (lab only), so this is
+# http://, not https://.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-backend
+spec:
+  provider:
+    vault:
+      server: "http://vault.vault.svc.cluster.local:8200"
+      path: "secret"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "external-secrets"
+          serviceAccountRef:
+            name: "external-secrets"
+            namespace: "external-secrets"