tegwick
ca6a608b16
The 768h orphan token in external-secrets/openbao-audit-core-eso-token expired at 2026-09-14T10:23Z and ClusterSecretStore lookup-self is 403, so ESO cannot mint database/creds/audit-core-runtime. Recreate the Kubernetes Secret without last-applied-configuration so the token is not stored in annotation metadata. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
23 lines
1 KiB
Bash
Executable file
23 lines
1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Attended remint of the ESO orphan token, then force-sync the runtime lease.
|
|
# Never prints secret values. Run inside:
|
|
# warden access openbao-platform-admin-login --exec -- \
|
|
# env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
|
|
# "$PWD/scripts/renew-runtime-lease.sh"
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
|
|
export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
|
|
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
|
|
|
|
"$ROOT/scripts/openbao-eso-token-apply.sh"
|
|
|
|
# One read of database/creds/audit-core-runtime = one new lease. Annotate
|
|
# only the runtime ExternalSecret; migrate/senders follow on their own
|
|
# refresh once the store is Ready.
|
|
kubectl -n audit-core annotate externalsecret audit-core-database \
|
|
force-sync="$(date -u +%s)" --overwrite
|
|
|
|
echo "ESO token reminted and audit-core-database force-sync requested."
|
|
echo "Wait for ExternalSecret Ready=True; do not restart the receiver."
|