Add step to run secret_store_sync before instance startup

Closes-Bug: 1744151
Change-Id: Ibe4e5023b8773ee70ee914118628acc5c149f379
(cherry picked from commit 86793eea52)

docker/services/barbican-api.yaml

@@ -148,6 +148,23 @@ outputs:
                 - {get_attr: [BarbicanApiLogging, cmd_extra_args]}
                 - "db upgrade"
                 - "'"
+          barbican_api_secret_store_sync:
+            start_order: 1
+            image: *barbican_api_image
+            net: host
+            detach: false
+            user: root
+            volumes: *barbican_api_volumes
+            command:
+              # NOTE(jaosorior): When providing extra arguments, we need to make sure that they're part
+              # of the bash -c invocation, so we include them in the quoted db sync command. Hence the
+              # final single quote that's part of the list_join.
+              list_join:
+              - ' '
+              - - "/usr/bin/bootstrap_host_exec barbican_api su barbican -s /bin/bash -c '/usr/bin/barbican-manage"
+                - {get_attr: [BarbicanApiLogging, cmd_extra_args]}
+                - "db sync_secret_stores --verbose"
+                - "'"
           barbican_api:
             # NOTE(alee): Barbican should start after keystone processes
             start_order: 5