Add ExternalSecret for ISSUE_CORE_API_KEY on Railiance

Sync the shared issue-core ingestion key from OpenBao into
actcore-runtime-secret via External Secrets, with an interim coulombcore
ClusterSecretStore bootstrap script and deploy docs. Removes manual key
injection from bootstrap-secrets.sh.

k8s/railiance/15-externalsecret-issue-core.yaml

@@ -0,0 +1,35 @@
+# Sync ISSUE_CORE_API_KEY from OpenBao into actcore-runtime-secret.
+#
+# Prereqs on railiance01:
+#   - External Secrets Operator (namespace external-secrets)
+#   - ClusterSecretStore openbao-activity-core (railiance-platform addon)
+#   - Secret external-secrets/openbao-activity-core-eso-token (scripts/openbao-eso-token-apply.sh)
+#
+# OpenBao path: platform/workloads/issue-core/issue-core/issue-core-runtime
+#   property: ISSUE_CORE_API_KEY (shared with issue-core ingestion)
+#
+# Merge keeps bootstrap-owned keys (ACTCORE_DB_URL, webhook secrets) intact.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actcore-issue-core-runtime
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-activity-core
+  target:
+    name: actcore-runtime-secret
+    creationPolicy: Merge
+    deletionPolicy: Retain
+  data:
+    - secretKey: ISSUE_CORE_API_KEY
+      remoteRef:
+        key: platform/workloads/issue-core/issue-core/issue-core-runtime
+        property: ISSUE_CORE_API_KEY

k8s/railiance/README.md

@@ -10,6 +10,8 @@ name and access policy.
 - `00-namespace.yaml`: namespace and shared labels
 - `10-infrastructure.yaml`: PostgreSQL for app data, PostgreSQL for Temporal,
   NATS JetStream, Temporal, and Temporal UI
+- `15-externalsecret-issue-core.yaml`: OpenBao → `ISSUE_CORE_API_KEY` merge into
+  `actcore-runtime-secret` via External Secrets
 - `20-runtime.yaml`: migrate/sync jobs plus API, worker, and event-router
 - `bootstrap-secrets.sh`: idempotently creates generated Kubernetes secrets
 
@@ -24,12 +26,15 @@ the ConfigMap projection from that file before enabling the probe schedule.
 `OPS_HUB_KEY` is created only as an empty Secret placeholder until the operator
 provisions the Inter-Hub ops-hub key.
 
-`ISSUE_SINK_TYPE` is `rest` in `actcore-runtime-config`. Populate
-`ISSUE_CORE_API_KEY` in `actcore-runtime-secret` with the same value as the
-issue-core runtime secret (`issue-core/issue-core-runtime` via OpenBao lane
-`issue-core-ingestion-api-key`) before trusting live task emission. Roll back
-to audit mode by setting `ISSUE_SINK_TYPE=null` and restarting worker and
-event-router deployments. See `docs/issue-core-emission-boundary.md`.
+`ISSUE_SINK_TYPE` is `rest` in `actcore-runtime-config`. `ISSUE_CORE_API_KEY`
+is synced from OpenBao into `actcore-runtime-secret` by ExternalSecret
+`actcore-issue-core-runtime` (same path as issue-core:
+`platform/workloads/issue-core/issue-core/issue-core-runtime`). Prereqs:
+`ClusterSecretStore/openbao-activity-core` and ESO token bootstrap
+(`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`).
+Roll back to audit mode by setting
+`ISSUE_SINK_TYPE=null` and restarting worker and event-router deployments.
+See `docs/issue-core-emission-boundary.md`.
 
 The same runtime projection now includes the active
 `daily-statehub-wsjf-triage.md` ActivityDefinition plus its JSON output schema
@@ -61,6 +66,11 @@ ssh railiance01
 cd ~/activity-core
 bash k8s/railiance/bootstrap-secrets.sh
 kubectl apply -f k8s/railiance/10-infrastructure.yaml
+# Bootstrap OpenBao ESO token + apply ExternalSecret (once per cluster):
+OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh
+kubectl apply -f ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml
+kubectl apply -f k8s/railiance/15-externalsecret-issue-core.yaml
+kubectl -n activity-core wait --for=condition=Ready externalsecret/actcore-issue-core-runtime --timeout=120s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-app-db --timeout=180s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-temporal-db --timeout=180s
 kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-nats --timeout=180s

k8s/railiance/bootstrap-secrets.sh

@@ -37,9 +37,8 @@ if ! secret_exists actcore-runtime-secret; then
     --from-literal=ACTCORE_DB_URL="$ACTCORE_DB_URL" \
     --from-literal=WEBHOOK_SECRET_GITEA="" \
     --from-literal=WEBHOOK_SECRET_GITHUB="" \
-    --from-literal=OPS_HUB_KEY="" \
-    --from-literal=ISSUE_CORE_API_KEY=""
+    --from-literal=OPS_HUB_KEY=""
 fi
-# When promoting live task emission, patch ISSUE_CORE_API_KEY on
-# actcore-runtime-secret to match issue-core's runtime secret. Never commit the
-# value; use the OpenBao lane documented in issue-core-ingestion-api-key.
+# ISSUE_CORE_API_KEY is merged into actcore-runtime-secret by ExternalSecret
+# actcore-issue-core-runtime (k8s/railiance/15-externalsecret-issue-core.yaml).
+# Apply that manifest after ClusterSecretStore openbao-activity-core is Ready.