Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.
- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
Deploy goodtune/ghp so estate agents have a GitHub proxy. Mirrors the
artifactapi app structure under apps/base/ghp with a CNPG Postgres backend,
VSO-synced GitHub App + encryption secrets, an internal Vault-PKI serving cert,
a PreSync migration hook, and platform ApplicationSet/project registration.
unkin-agent