CNF-22724: Add External Secrets Operator reference configuration

Add ESO as an optional operator for the telco-hub and telco-core RDS,
providing secure secret management via external stores (Vault example).

Hub configuration includes:
- Namespace, OperatorGroup, Subscription, ExternalSecretsConfig,
  ClusterSecretStore (ztp-secret-provider)
- ClusterInstance template ConfigMaps for pull secret and BMC
  credentials ExternalSecrets
- kube-compare metadata (allOrNoneOf, optional)
- example-overlays-config with ClusterSecretStore patch
- README documenting usage, vault path conventions, and
  templateRefs integration

Core configuration includes ESO in the PolicyGenerator baseline
(included by default, not commented out).

Co-authored-by: Claude

Author: rdiscala

telco-core/configuration/core-baseline.yaml

@@ -52,6 +52,14 @@ policies:
       # - path: reference-crs/optional/cert-manager/certManagerOperatorgroup.yaml
       # - path: reference-crs/optional/cert-manager/certManagerSubscription.yaml
 
+      # External Secrets Operator (optional component - included by default)
+      - path: reference-crs/optional/external-secrets/esoNS.yaml
+      - path: reference-crs/optional/external-secrets/esoOperatorgroup.yaml
+      - path: reference-crs/optional/external-secrets/esoSubscription.yaml
+        patches:
+        - spec:
+            installPlanApproval: Manual
+
       - path: reference-crs/required/networking/sriov/SriovSubscriptionNS.yaml
       - path: reference-crs/required/networking/sriov/SriovSubscriptionOperGroup.yaml
       - path: reference-crs/required/networking/sriov/SriovSubscription.yaml
@@ -89,6 +97,11 @@ policies:
     policyAnnotations:
       ran.openshift.io/ztp-deploy-wave: "6"
     manifests:
+      # External Secrets Operator configuration (optional component - included by default)
+      - path: reference-crs/optional/external-secrets/esoExternalSecretsConfig.yaml
+      - path: reference-crs/optional/external-secrets/esoClusterSecretStore.yaml
+      - path: reference-crs/optional/external-secrets/esoNetworkPolicy.yaml
+
       - path: reference-crs/optional/logging/ClusterLogServiceAccount.yaml
       - path: reference-crs/optional/logging/ClusterLogServiceAccountAuditBinding.yaml
       - path: reference-crs/optional/logging/ClusterLogServiceAccountInfrastructureBinding.yaml

telco-core/configuration/reference-crs-kube-compare/metadata.yaml

@@ -206,6 +206,22 @@ parts:
         allOf:
           - path: optional/other/mount_namespace_config_master.yaml
           - path: optional/other/mount_namespace_config_worker.yaml
+  - name: optional-external-secrets
+    description: |-
+      External Secrets Operator for secure secret management via external stores
+    components:
+      - name: external-secrets-operator
+        allOrNoneOf:
+          - path: optional/external-secrets/esoNS.yaml
+          - path: optional/external-secrets/esoOperatorgroup.yaml
+          - path: optional/external-secrets/esoSubscription.yaml
+          - path: optional/external-secrets/esoExternalSecretsConfig.yaml
+          - path: optional/external-secrets/esoClusterSecretStore.yaml
+            config:
+              ignore-unspecified-fields: true
+          - path: optional/external-secrets/esoNetworkPolicy.yaml
+            config:
+              ignore-unspecified-fields: true
   - name: optional-cert-manager
     description: |-
       Cert-manager operator for automated certificate management

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoClusterSecretStore.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: ztp-secret-provider
+spec:
+  conditions:
+    - namespaceSelector:
+        matchExpressions:
+          - key: cluster.open-cluster-management.io/managedCluster
+            operator: Exists
+  provider:
+    vault:
+      server: {{ .spec.provider.vault.server | quote }}
+      path: {{ .spec.provider.vault.path | quote }}
+      version: {{ .spec.provider.vault.version | quote }}
+      auth:
+        tokenSecretRef:
+          name: {{ .spec.provider.vault.auth.tokenSecretRef.name }}
+          key: {{ .spec.provider.vault.auth.tokenSecretRef.key }}
+          namespace: {{ .spec.provider.vault.auth.tokenSecretRef.namespace }}

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoExternalSecretsConfig.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: operator.openshift.io/v1alpha1
+kind: ExternalSecretsConfig
+metadata:
+  name: cluster
+spec: {}

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoNS.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    workload.openshift.io/allowed: management
+  name: external-secrets-operator

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoNetworkPolicy.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-secret-store-egress
+  namespace: external-secrets
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-secrets
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+      ports:
+        - port: 8200
+          protocol: TCP

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoOperatorgroup.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  annotations:
+    operatorframework.io/bundle-unpack-timeout: "10m"
+    operatorframework.io/bundle-unpack-min-retry-interval: 10m
+  name: external-secrets-operator
+  namespace: external-secrets-operator
+spec:
+  upgradeStrategy: Default

telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoSubscription.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-external-secrets-operator
+  namespace: external-secrets-operator
+spec:
+  channel: stable-v1
+  name: openshift-external-secrets-operator
+  source: redhat-operators-disconnected
+  sourceNamespace: openshift-marketplace
+  installPlanApproval: Manual
+status:
+  state: AtLatestKnown

telco-core/configuration/reference-crs/optional/external-secrets/esoClusterSecretStore.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: ztp-secret-provider
+spec:
+  # Restrict store usage to RHACM managed-cluster namespaces only
+  conditions:
+    - namespaceSelector:
+        matchExpressions:
+          - key: cluster.open-cluster-management.io/managedCluster
+            operator: Exists
+  provider:
+    vault:
+      server: "https://vault.example.com:8200"
+      path: "secret"
+      version: "v2"
+      auth:
+        tokenSecretRef:
+          name: vault-token
+          key: token
+          namespace: external-secrets-operator

telco-core/configuration/reference-crs/optional/external-secrets/esoExternalSecretsConfig.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: operator.openshift.io/v1alpha1
+kind: ExternalSecretsConfig
+metadata:
+  name: cluster
+spec: {}