apiVersion: railiance.fabric/v1alpha1
kind: InterfaceDeclaration
metadata:
  id: railiance-platform.openbao.kv-v2
  name: OpenBao KV v2 mount
  owner: railiance-platform
  repo: railiance-platform
  domain: railiance
  source_links:
    - label: OpenBao KV mount manifest
      path: manifests/openbao/kv-v2.yaml
spec:
  lifecycle: active
  environments: [dev, staging, prod]
  description: KV v2 secret mount exposed to approved Railiance workloads.
  interface_type: openbao-kv-v2-mount
  version: v1
  service_id: railiance-platform.openbao
  capability_ids:
    - railiance-platform.openbao.runtime-secrets
  endpoint:
    path: secret/data/railiance
  auth:
    method: kubernetes_service_account
    audience: openbao
  data_classification: secret
  compatibility:
    version: v1
    notes: Consumers must use workload service-account authentication.