ghp: use the estate templated default Vault convention

Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.

- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
  kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.

apps/base/ghp/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       labels:
         app: ghp
     spec:
-      serviceAccountName: ghp
+      serviceAccountName: default
       automountServiceAccountToken: true
       securityContext:
         runAsNonRoot: true

apps/base/ghp/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
   - configmap.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml

apps/base/ghp/migrate-job.yaml

@@ -25,7 +25,7 @@ spec:
       labels:
         app: ghp-migrate
     spec:
-      serviceAccountName: ghp
+      serviceAccountName: default
       automountServiceAccountToken: true
       restartPolicy: Never
       securityContext:

apps/base/ghp/serviceaccount.yaml

@@ -1,8 +0,0 @@
----
-# Bound to the Vault K8s auth role "ghp" (added in terraform-vault); VSO uses the
-# VaultAuth below to exchange this SA's token for a Vault token and sync kv.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ghp
-  namespace: ghp

apps/base/ghp/vaultauth.yaml

@@ -12,8 +12,8 @@ spec:
   kubernetes:
     audiences:
       - vault
-    role: ghp
-    serviceAccount: ghp
+    role: default
+    serviceAccount: default
     tokenExpirationSeconds: 600
   method: kubernetes
   mount: k8s/au/syd1

apps/base/ghp/vaultstaticsecret.yaml

@@ -1,6 +1,8 @@
 ---
-# GitHub App credentials (app_id, client_id, client_secret, private_key).
-# Ben populates kv/kubernetes/ghp/github-app via the runbook; VSO syncs it here.
+# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
+# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
+# default k8s role's templated policy already grants read here, so no
+# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -15,12 +17,13 @@ spec:
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: kubernetes/ghp/github-app
+  path: kubernetes/namespace/ghp/default/github-app
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
 ---
-# Application encryption key (encryption_key) from kv/kubernetes/ghp/app.
+# Application encryption key (encryption_key) from
+# kv/kubernetes/namespace/ghp/default/app.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -35,7 +38,7 @@ spec:
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: kubernetes/ghp/app
+  path: kubernetes/namespace/ghp/default/app
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default