Credentials map (reference)

No secret values here — only where each lives. Vault: vault.airgap.lab:8200, KV mount apps/; reach a Vault node via ssh ze@dl385-2 'ssh root@192.168.130.21 ...'.

Cluster & infra

Secret Location
kubeadmin (per cluster) on-host /root/<cluster>/auth/kubeadmin-password
Console SSO user zeadmin Vault apps/keycloak/oidc (testuser-password)
Quay mirror registry init on-host; CA /opt/quay/quay-rootCA
GitLab administrator + PAT on-host /root/gitlab-credentials.txt
Argo read-only deploy token Vault apps/gitlab/argo-deploy
Vault init (root + unseal) on-host /root/vault-ha-init.json (transit: /root/vault-transit-init.json)
Jenkins / Nexus admin Vault apps/jenkins/admin / apps/nexus/admin

Vault apps/ KV (served to clusters via ESO)

Path Used by
apps/keycloak/oidc Keycloak DB/client, console OIDC, ACS secret
apps/minio/{root,velero,infra,loki,obs} MinIO root; Velero; infra-backup; Loki; ACM Thanos
apps/gitlab/argo-deploy Argo deploy token
apps/acs/* ACS Central admin / keycloak-client
apps/cosign/demo-signing cosign signing key
apps/postgres/*, apps/keycloak/* middleware/app secrets

PKI / KMS

Item Location
Airgap Lab root CA (offline) on-host /root/ca (bastion)
Vault PKI intermediate (pki, 3y) Vault mount pki, role airgap-lab
Quay registry CA (separate) on-host /opt/quay/quay-rootCA/rootCA.pem
ODF per-OSD KMS keys Vault KV odf/; token secret ocs-kms-token

Delivery mechanisms (no static secrets in git)

Mechanism Detail
ESO ClusterSecretStore vault, k8s auth (mounts k8s-hub/k8s-wl/k8s-wl-dr, role eso), reads apps/
cert-manager ClusterIssuer vault-issuer (role cert-manager, audience vault://vault-issuer)
Argo repo auth gitops-repo secret (deploy token) — out-of-band, not in git
Ramen S3 s3secret-* in openshift-operators — runtime, via scripts/reintegrate-ramen-dr.sh

Note: git history of the legacy RUNBOOK.md once held live values; all exposed credentials were rotated 2026-07-10 (history values now invalid).