# Sync ops_run queue worker tokens from OpenBao into actcore-runtime-secret.
#
# NOT YET APPLIED (ACTIVITY-WP-0039). Apply only after T02 (railiance-platform
# adds both exact paths to the activity-core-eso role policy) and T03 (the
# founder seeds both paths). Applying earlier makes the store fail to read,
# or overwrites the hand-set ACTIVITY_CORE_WORKER_TOKEN with a missing value.
#
# Prereqs on railiance01:
#   - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
#     Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
#     RPF-WP-0045)
#
# One path per worker identity (field: token), so a consumer lane can be
# granted exactly one worker's token:
#   rein-aharness@railiance01          -> ACTIVITY_CORE_WORKER_TOKEN
#   rein-aharness-metered@railiance01  -> ACTIVITY_CORE_WORKER_TOKEN_METERED
# The identity map is the non-secret ACTIVITY_CORE_WORKERS in
# actcore-runtime-config.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: actcore-ops-run-worker-tokens
  namespace: activity-core
  labels:
    app.kubernetes.io/name: activity-core
    app.kubernetes.io/part-of: activity-core
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-activity-core
  target:
    name: actcore-runtime-secret
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: ACTIVITY_CORE_WORKER_TOKEN
      remoteRef:
        key: platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01
        property: token
    - secretKey: ACTIVITY_CORE_WORKER_TOKEN_METERED
      remoteRef:
        key: platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01
        property: token