Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

deploy/externalsecrets.yaml

@@ -1,14 +1,12 @@
 # Credential delivery for audit-core (AUDIT-WP-0005-T02).
 #
-# Follows the ClusterSecretStore -> ExternalSecret -> Secret pattern already in
-# use by activity-core and rapp-qonto. audit-core never holds a credential in
-# its own configuration; it reads whatever is currently mounted.
+# Two sources, because they are two kinds of secret:
+#   - database leases: VaultDynamicSecret -> ExternalSecret (this file)
+#   - sender registry: ClusterSecretStore openbao-audit-core -> ExternalSecret
 #
-# PREREQUISITE (rapp-postgres / railiance-platform, not this repo):
-#   - a ClusterSecretStore named openbao-audit-core, scoped to this namespace
-#   - the OpenBao database role rapp-postgres/audit-core-runtime issuing leases
-#     against the audit_core_app group role
-# Apply order: ClusterSecretStore, then this, then the Deployment.
+# audit-core never holds a credential in its own configuration; it reads
+# whatever is currently mounted. Apply order: namespace, ESO token,
+# ClusterSecretStore, VaultDynamicSecret, this, migrate Job, Deployment.
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -19,9 +17,6 @@ spec:
   # Shorter than the platform default of 1h: these are dynamic leases, and the
   # refresh interval bounds how long a revoked lease can remain mounted.
   refreshInterval: 15m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao-audit-core
   target:
     name: audit-core-database
     creationPolicy: Owner
@@ -37,15 +32,38 @@ spec:
         host: platform-pg-rw.databases.svc.cluster.local
         port: "5432"
         dbname: audit_core
-  data:
-    - secretKey: username
-      remoteRef:
-        key: platform/workloads/audit-core/database/audit-core-runtime
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: platform/workloads/audit-core/database/audit-core-runtime
-        property: password
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: VaultDynamicSecret
+          name: audit-core-runtime
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: audit-core-database-migrate
+  namespace: audit-core
+spec:
+  refreshInterval: 15m
+  target:
+    name: audit-core-database-migrate
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      engineVersion: v2
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+        host: platform-pg-rw.databases.svc.cluster.local
+        port: "5432"
+        dbname: audit_core
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: VaultDynamicSecret
+          name: audit-core-migration
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -71,5 +89,6 @@ spec:
     # between, so there is no delivery gap.
     - secretKey: senders.json
       remoteRef:
-        key: platform/workloads/audit-core/senders
+        # CSS already mounts KV path `platform`; do not repeat the prefix.
+        key: workloads/audit-core/senders
         property: senders.json