vault migration

infra/base/renovate/kustomization.yaml

@@ -2,4 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - renovate.yaml
-- renovate-env-sealed.yaml
+- vault-auth.yaml
+- renovate-env-vault.yaml
+# Removed: renovate-env-sealed.yaml (migrated to VSO)

infra/base/renovate/renovate-env-vault.yaml

@@ -0,0 +1,17 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: renovate-env
+  namespace: renovate
+spec:
+  type: kv-v2
+  mount: kv
+  path: renovate/renovate-env
+  destination:
+    name: renovate-env
+    create: true
+    type: Opaque
+    labels:
+      allowedToBeCloned: "true"
+  refreshAfter: 30s
+  vaultAuthRef: vault-auth

infra/base/renovate/vault-auth.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-auth-renovate
+  namespace: renovate
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vault-auth
+  namespace: renovate
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: ns-renovate
+    serviceAccount: vault-auth-renovate
+    audiences:
+    - vault