Skip to content

Commit 2b1daf9

Browse files
rdiscalardiscala
committed
CNF-22724: Add External Secrets Operator reference configuration
Add ESO as an optional operator for the telco-hub and telco-core RDS, providing secure secret management via external stores (Vault example). Hub configuration includes: - Namespace, OperatorGroup, Subscription, ExternalSecretsConfig, ClusterSecretStore (ztp-secret-provider) - ClusterInstance template ConfigMaps for pull secret and BMC credentials ExternalSecrets - kube-compare metadata (allOrNoneOf, optional) - example-overlays-config with ClusterSecretStore patch - README documenting usage, vault path conventions, and templateRefs integration Core configuration includes ESO in the PolicyGenerator baseline (included by default, not commented out). Co-authored-by: Claude
1 parent 85eb3fb commit 2b1daf9

36 files changed

Lines changed: 595 additions & 0 deletions

‎telco-core/configuration/core-baseline.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,14 @@ policies:
5252
# - path: reference-crs/optional/cert-manager/certManagerOperatorgroup.yaml
5353
# - path: reference-crs/optional/cert-manager/certManagerSubscription.yaml
5454

55+
# External Secrets Operator (optional component - included by default)
56+
- path: reference-crs/optional/external-secrets/esoNS.yaml
57+
- path: reference-crs/optional/external-secrets/esoOperatorgroup.yaml
58+
- path: reference-crs/optional/external-secrets/esoSubscription.yaml
59+
patches:
60+
- spec:
61+
installPlanApproval: Manual
62+
5563
- path: reference-crs/required/networking/sriov/SriovSubscriptionNS.yaml
5664
- path: reference-crs/required/networking/sriov/SriovSubscriptionOperGroup.yaml
5765
- path: reference-crs/required/networking/sriov/SriovSubscription.yaml
@@ -90,6 +98,10 @@ policies:
9098
policyAnnotations:
9199
ran.openshift.io/ztp-deploy-wave: "6"
92100
manifests:
101+
# External Secrets Operator configuration (optional component - included by default)
102+
- path: reference-crs/optional/external-secrets/esoExternalSecretsConfig.yaml
103+
- path: reference-crs/optional/external-secrets/esoClusterSecretStore.yaml
104+
93105
- path: reference-crs/optional/logging/ClusterLogServiceAccount.yaml
94106
- path: reference-crs/optional/logging/ClusterLogServiceAccountAuditBinding.yaml
95107
- path: reference-crs/optional/logging/ClusterLogServiceAccountInfrastructureBinding.yaml

‎telco-core/configuration/reference-crs-kube-compare/metadata.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,19 @@ parts:
201201
allOf:
202202
- path: optional/other/mount_namespace_config_master.yaml
203203
- path: optional/other/mount_namespace_config_worker.yaml
204+
- name: optional-external-secrets
205+
description: |-
206+
External Secrets Operator for secure secret management via external stores
207+
components:
208+
- name: external-secrets-operator
209+
allOrNoneOf:
210+
- path: optional/external-secrets/esoNS.yaml
211+
- path: optional/external-secrets/esoOperatorgroup.yaml
212+
- path: optional/external-secrets/esoSubscription.yaml
213+
- path: optional/external-secrets/esoExternalSecretsConfig.yaml
214+
- path: optional/external-secrets/esoClusterSecretStore.yaml
215+
config:
216+
ignore-unspecified-fields: true
204217
- name: optional-cert-manager
205218
description: |-
206219
Cert-manager operator for automated certificate management

‎telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoClusterSecretStore.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: external-secrets.io/v1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: ztp-secret-provider
6+
spec:
7+
provider:
8+
vault:
9+
server: "https://vault.example.com:8200"
10+
path: "secret"
11+
version: "v2"
12+
auth:
13+
tokenSecretRef:
14+
name: vault-token
15+
key: token
16+
namespace: external-secrets-operator

‎telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoExternalSecretsConfig.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: operator.openshift.io/v1alpha1
3+
kind: ExternalSecretsConfig
4+
metadata:
5+
name: cluster
6+
spec: {}

‎telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoNS.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
annotations:
6+
workload.openshift.io/allowed: management
7+
name: external-secrets-operator

‎telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoOperatorgroup.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: operators.coreos.com/v1
3+
kind: OperatorGroup
4+
metadata:
5+
annotations:
6+
olm.operatorframework.io/bundle-install-timeout: "10m"
7+
operatorframework.io/bundle-unpack-min-retry-interval: 10m
8+
name: external-secrets-operator
9+
namespace: external-secrets-operator
10+
spec:
11+
upgradeStrategy: Default

‎telco-core/configuration/reference-crs-kube-compare/optional/external-secrets/esoSubscription.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: operators.coreos.com/v1alpha1
3+
kind: Subscription
4+
metadata:
5+
name: openshift-external-secrets-operator
6+
namespace: external-secrets-operator
7+
spec:
8+
channel: stable-v1
9+
name: openshift-external-secrets-operator
10+
source: redhat-operators-disconnected
11+
sourceNamespace: openshift-marketplace
12+
installPlanApproval: Manual
13+
status:
14+
state: AtLatestKnown

‎telco-core/configuration/reference-crs/optional/external-secrets/esoClusterSecretStore.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: external-secrets.io/v1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: ztp-secret-provider
6+
spec:
7+
provider:
8+
vault:
9+
server: "https://vault.example.com:8200"
10+
path: "secret"
11+
version: "v2"
12+
auth:
13+
tokenSecretRef:
14+
name: vault-token
15+
key: token
16+
namespace: external-secrets-operator

‎telco-core/configuration/reference-crs/optional/external-secrets/esoExternalSecretsConfig.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: operator.openshift.io/v1alpha1
3+
kind: ExternalSecretsConfig
4+
metadata:
5+
name: cluster
6+
spec: {}

‎telco-core/configuration/reference-crs/optional/external-secrets/esoNS.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
annotations:
6+
workload.openshift.io/allowed: management
7+
name: external-secrets-operator

0 commit comments

Comments
 (0)