feat: sync OpenBao secrets to GitHub Actions via ESO#9
Merged
Conversation
Cables ESO to OpenBao (ClusterSecretStore openbao, provider vault, auth
kubernetes via the external-secrets role created manually on OpenBao)
and adds apps/secrets-sync/, which pushes secrets stored in OpenBao to
GitHub Actions secrets (organization / repo / environment) via ESO
PushSecret.
Each target gets its own dedicated OpenBao secret
(kv/apps/secrets-sync/github/<name>) rather than one shared blob, so
unrelated destinations don't share a Vault version history or an
access policy. Deploys clusters/{local,scaleway}/templates/secrets-sync.yaml;
scaleway ships with targets: [] since GitHub is a global resource and
only one cluster should push to it.
Requires a GitHub App with Secrets (repo), Environments (repo), and
Organization secrets permissions, installed on the org with access to
the target repos — each permission added after the fact needs explicit
acceptance on the org's installation page. The manual OpenBao-side
config (kubernetes auth, eso-read policy, external-secrets role, KV v2
engine) lives outside git; fully documented with replayable commands
in openbao-claude.md at the IntegratedDynamic repo root.
Validated end-to-end on minikube: org, repo, and environment-scoped
secrets confirmed live on GitHub via the API after each iteration of
this design (including the per-target and github/ prefix refactors
folded into this squashed commit), and the real Scaleway credentials
now flowing to the infrastructure repo's scaleway environment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
nbrieussel
force-pushed
the
feat/eso-github-secrets-sync
branch
from
July 20, 2026 15:08
0b7e770 to
0c617f4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Résumé
ClusterSecretStoreopenbao, providervault, auth kubernetes via le rôleexternal-secretscréé côté OpenBao).apps/secrets-sync/: synchronise des secrets stockés dans OpenBao vers les Actions secrets GitHub (organisation / repo / environnement), via ESOPushSecret.kv/apps/secrets-sync/github/<name>), pas un blob partagé — évite de coupler la rotation de secrets sans rapport et permet une policy d'accès par cible.clusters/{local,scaleway}/templates/secrets-sync.yaml. Le clusterscalewayest volontairement désactivé (targets: []) : GitHub est une ressource globale, un seul cluster doit faire autorité pour éviter deux sources d'écriture concurrentes.Contexte / prérequis
eso-read, rôleexternal-secrets, moteur KV v2) est appliquée manuellement, hors git — documentée avec toutes les commandes dansopenbao-claude.mdà la racine du repoIntegratedDynamic.Validation
Testé de bout en bout sur minikube : trois secrets de test (
TEST_ORGAen secret d'organisation,TEST_REPOen secret du repoinfrastructure,TEST_SCALEWAYen secret de l'environnementscalewaydu même repo) écrits dans OpenBao et confirmés visibles côté GitHub via l'API (gh api .../actions/secrets).Plan de test
secrets-syncApplication ArgoCD passeSynced/Healthysur le cluster localExternalSecret/PushSecret/SecretStorerestentReady=Trueaprès un sync ArgoCD complet (pas seulement unkubectl applymanuel)🤖 Generated with Claude Code
https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43