Give vlogs its own namespace (#507)

The Vault KV layout is kubernetes/namespace/<ns>/<sa>/<secret>, so vlogs and logviewer both running as SA default in the shared logging namespace would collide on one oauth-credentials entry. Splitting vlogs out resolves it without widening any Vault policy.

- Move apps/base/logging/vlogs to apps/base/vlogs, namespace vlogs
- Add namespace.yaml and a vlogs-scoped VaultAuth (role default)
- Point the VaultStaticSecret at kubernetes/namespace/vlogs/default/oauth-credentials
- Add the au-syd1 overlay, platform ApplicationSet path and project destination
- Move the wildcard-unkin-net-tls reflection from logging to vlogs; vlogs was its only consumer there

Secret is already seeded at the new Vault path.

Reviewed-on: #507
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #507.

This commit is contained in:

Unkin Agent

2026-09-28 22:55:28 +10:00

committed by

BenVincent

parent c979579c50

commit e6e882abfc

14 changed files with 44 additions and 11 deletions

									
										apps/base/logging/kustomization.yaml
									
		-1
	
												View File
												
				@@ -9,4 +9,3 @@ resources:

				  - vlagent.yaml

				  - gateway.yaml

				  - httproute.yaml

				  - vlogs