From ca6a608b16648ed63dddb2761070dc3f351157fd Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 14 Sep 2026 23:54:35 +0200
Subject: [PATCH] Add attended runtime-lease remint helper for the expired ESO
 token

The 768h orphan token in external-secrets/openbao-audit-core-eso-token
expired at 2026-09-14T10:23Z and ClusterSecretStore lookup-self is 403,
so ESO cannot mint database/creds/audit-core-runtime. Recreate the
Kubernetes Secret without last-applied-configuration so the token is
not stored in annotation metadata.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
---
 scripts/openbao-eso-token-apply.sh |  8 +++++---
 scripts/renew-runtime-lease.sh     | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100755 scripts/renew-runtime-lease.sh

diff --git a/scripts/openbao-eso-token-apply.sh b/scripts/openbao-eso-token-apply.sh
index f1b17f4..5fad508 100755
--- a/scripts/openbao-eso-token-apply.sh
+++ b/scripts/openbao-eso-token-apply.sh
@@ -93,10 +93,12 @@ if kubectl get ns core-hub-staging >/dev/null 2>&1; then
   echo "ERROR: kubeconfig looks like coulombcore (namespace core-hub-staging present)." >&2
   exit 1
 fi
+# Recreate rather than kubectl-apply: apply writes the token into
+# last-applied-configuration, which is readable as Secret metadata.
+kubectl -n "$SECRET_NS" delete secret "$SECRET_NAME" --ignore-not-found
 kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \
-  --from-literal=token="$child_token" \
-  --dry-run=client -o yaml | kubectl apply -f -
+  --from-literal=token="$child_token"
 
 unset child_token BAO_TOKEN
 echo "Secret $SECRET_NS/$SECRET_NAME applied on railiance01."
-echo "Next: apply ClusterSecretStore openbao-audit-core, then deploy/."
+echo "Next: force-sync ExternalSecret audit-core-database; do not bounce the pod."
diff --git a/scripts/renew-runtime-lease.sh b/scripts/renew-runtime-lease.sh
new file mode 100755
index 0000000..67fb69d
--- /dev/null
+++ b/scripts/renew-runtime-lease.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Attended remint of the ESO orphan token, then force-sync the runtime lease.
+# Never prints secret values. Run inside:
+#   warden access openbao-platform-admin-login --exec -- \
+#     env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
+#     "$PWD/scripts/renew-runtime-lease.sh"
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
+export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
+export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
+
+"$ROOT/scripts/openbao-eso-token-apply.sh"
+
+# One read of database/creds/audit-core-runtime = one new lease. Annotate
+# only the runtime ExternalSecret; migrate/senders follow on their own
+# refresh once the store is Ready.
+kubectl -n audit-core annotate externalsecret audit-core-database \
+  force-sync="$(date -u +%s)" --overwrite
+
+echo "ESO token reminted and audit-core-database force-sync requested."
+echo "Wait for ExternalSecret Ready=True; do not restart the receiver."