25cabaed76
Makes the key at OpenBao `infrastructure/uptime-robot`, field `api_key`, available as a Secret in the new `uptime-monitor` namespace and nowhere else. No new operator: this uses the External Secrets Operator and the `openbao` ClusterSecretStore the cluster already runs. Nothing is monitored by this commit. The namespace holds only the key; the IngressMonitorController, its ServiceAccount and its RBAC arrive separately (REN-6). * `data` + `property` instead of `dataFrom: extract`, so only the one field lands in the cluster rather than every field at the KV path. * Adds `uptime-monitor` to the ClusterSecretStore `conditions.namespaces` allowlist, sorted. Without this ESO reports "not allowed to reference ClusterSecretStore" and the Secret silently never syncs. * A DEDICATED Flux Kustomization rather than adding the ExternalSecret to infrastructure/post-crds. That path runs `wait: true` with no explicit healthChecks and 19 other Kustomizations dependOn it, so an ExternalSecret whose OpenBao path is not yet populated would never turn Ready and would stall most of the cluster. Here the blast radius of a missing key is this Kustomization alone, which nothing depends on. * No OpenBao policy change: eso-read already grants `homelab/data/*`. Co-Authored-By: Paperclip <noreply@paperclip.ing> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>