RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect

Declares target store specs, two exact-path policies and two ESO
ServiceAccounts. Nothing applied; live steps wait on the founder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml

@@ -1,10 +1,7 @@
-# activity-core reads runtime secrets from the private railiance01 OpenBao
-# service. Kubernetes auth remains the preferred follow-up identity.
-#
-# Prereq: Secret external-secrets/openbao-activity-core-eso-token (key: token)
-# with a policy-limited OpenBao token that can read
-# platform/workloads/issue-core/issue-core/issue-core-runtime (ISSUE_CORE_API_KEY).
-# Bootstrap: activity-core scripts/openbao-eso-token-apply.sh
+# RPF-WP-0045: exact namespace/SA/audience Kubernetes auth; no static token.
+# DECLARED TARGET, NOT YET LIVE. Live still references the expired
+# external-secrets/openbao-activity-core-eso-token until RPF-WP-0045-T03.
+# Nothing syncs this file (excluded from the kustomization).
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -19,10 +16,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-activity-core-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: activity-core-eso
+          serviceAccountRef:
+            name: activity-core-eso
+            namespace: activity-core
+            audiences:
+            - openbao
   conditions:
     - namespaces:
         - activity-core

argocd/platform-addons/openbao-secretstore/openbao-email-connect.clustersecretstore.yaml

@@ -1,13 +1,7 @@
-# email-connect transactional receiver reads SMTP + ingest token from OpenBao.
-# Deploy on railiance01 (not coulombcore ArgoCD kustomization — same interim
-# pattern as openbao-activity-core / openbao-reuse).
-#
-# Prereq: Secret external-secrets/openbao-email-connect-eso-token (key: token)
-# with policy external-secrets-email-connect (or
-# workload-kv-read-email-connect-transactional) able to read
-# platform/workloads/email-connect/transactional.
-# Bootstrap: email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh
-# CCR: CCR-2026-0010
+# RPF-WP-0045: exact namespace/SA/audience Kubernetes auth; no static token.
+# DECLARED TARGET, NOT YET LIVE. Live still references the expired
+# external-secrets/openbao-email-connect-eso-token until RPF-WP-0045-T03.
+# Nothing syncs this file (excluded from the kustomization). CCR: CCR-2026-0010.
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -23,10 +17,14 @@ spec:
       path: platform
       version: v2
       auth:
-        tokenSecretRef:
-          name: openbao-email-connect-eso-token
-          namespace: external-secrets
-          key: token
+        kubernetes:
+          mountPath: kubernetes
+          role: email-connect-transactional-eso
+          serviceAccountRef:
+            name: email-connect-eso
+            namespace: email-connect
+            audiences:
+            - openbao
   conditions:
     - namespaces:
         - email-connect