feat: deploy External Secrets Operator (ESO) via Flux + real ExternalSecrets

Add flux/external-secrets/ directory containing:
- namespace.yaml: external-secrets namespace
- helmrepository.yaml: charts.external-secrets.io HelmRepository
- helmrelease.yaml: ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0)
- clustersecretstore.yaml: ClusterSecretStore using Kubernetes provider
  (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore)
- kustomization.yaml: wires all above resources

Uncomment and complete ExternalSecret manifests in each API namespace:
- flux/zip-enrichment/externalsecret.yaml
- flux/holidays/externalsecret.yaml
- flux/air-quality/externalsecret.yaml

All three ExternalSecrets reference the kubernetes-provider ClusterSecretStore
and will auto-sync rapidapi-proxy-secret once ESO is running.

Add external-secrets to flux/kustomization.yaml.

kustomize build flux/ = PASS

Closes leeworks-agents/api-company#61

flux/air-quality/externalsecret.yaml

@@ -1,29 +1,18 @@
-# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+apiVersion: external-secrets.io/v1beta1
-# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+kind: ExternalSecret
-# the external-secrets operator are running in the cluster.
+metadata:
-#
+  name: rapidapi-proxy-secret
-# Example (uncomment and fill in secretStore name):
+  namespace: air-quality
-#
+spec:
-# apiVersion: external-secrets.io/v1beta1
+  refreshInterval: 1h
-# kind: ExternalSecret
+  secretStoreRef:
-# metadata:
+    name: kubernetes-provider
-#   name: rapidapi-proxy-secret
+    kind: ClusterSecretStore
-#   namespace: air-quality
+  target:
-# spec:
+    name: rapidapi-proxy-secret
-#   refreshInterval: 1h
+    creationPolicy: Owner
-#   secretStoreRef:
+  data:
-#     name: <your-secret-store>
+    - secretKey: X-RapidAPI-Proxy-Secret
-#     kind: ClusterSecretStore
+      remoteRef:
-#   target:
+        key: rapidapi-air-quality-source
-#     name: rapidapi-proxy-secret
+        property: X-RapidAPI-Proxy-Secret
-#     creationPolicy: Owner
-#   data:
-#     - secretKey: X-RapidAPI-Proxy-Secret
-#       remoteRef:
-#         key: rapidapi/air-quality
-#         property: proxy-secret
-#
-# Until then, create manually:
-# kubectl create secret generic rapidapi-proxy-secret \
-#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
-#   -n air-quality

flux/external-secrets/clustersecretstore.yaml

@@ -0,0 +1,50 @@
+# ClusterSecretStore using the Kubernetes provider.
+# Reads secrets from the cluster itself — no external vault required.
+# The service account below must have get/list access to secrets in
+# the namespaces where ExternalSecrets are created.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-kubernetes-provider
+  namespace: external-secrets
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: eso-kubernetes-provider-reader
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eso-kubernetes-provider-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eso-kubernetes-provider-reader
+subjects:
+  - kind: ServiceAccount
+    name: eso-kubernetes-provider
+    namespace: external-secrets
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: kubernetes-provider
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: external-secrets
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: external-secrets
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: eso-kubernetes-provider
+          namespace: external-secrets

flux/external-secrets/helmrelease.yaml

@@ -0,0 +1,30 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: external-secrets
+      version: ">=0.9.0 <1.0.0"
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-system
+      interval: 60m
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  values:
+    installCRDs: true
+    webhook:
+      port: 9443
+    certController:
+      requeueInterval: 5m

flux/external-secrets/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: flux-system
+spec:
+  interval: 60m
+  url: https://charts.external-secrets.io

flux/external-secrets/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - clustersecretstore.yaml

flux/external-secrets/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets

flux/holidays/externalsecret.yaml

@@ -1,29 +1,18 @@
-# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+apiVersion: external-secrets.io/v1beta1
-# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+kind: ExternalSecret
-# the external-secrets operator are running in the cluster.
+metadata:
-#
+  name: rapidapi-proxy-secret
-# Example (uncomment and fill in secretStore name):
+  namespace: holidays
-#
+spec:
-# apiVersion: external-secrets.io/v1beta1
+  refreshInterval: 1h
-# kind: ExternalSecret
+  secretStoreRef:
-# metadata:
+    name: kubernetes-provider
-#   name: rapidapi-proxy-secret
+    kind: ClusterSecretStore
-#   namespace: holidays
+  target:
-# spec:
+    name: rapidapi-proxy-secret
-#   refreshInterval: 1h
+    creationPolicy: Owner
-#   secretStoreRef:
+  data:
-#     name: <your-secret-store>
+    - secretKey: X-RapidAPI-Proxy-Secret
-#     kind: ClusterSecretStore
+      remoteRef:
-#   target:
+        key: rapidapi-holidays-source
-#     name: rapidapi-proxy-secret
+        property: X-RapidAPI-Proxy-Secret
-#     creationPolicy: Owner
-#   data:
-#     - secretKey: X-RapidAPI-Proxy-Secret
-#       remoteRef:
-#         key: rapidapi/holidays
-#         property: proxy-secret
-#
-# Until then, create manually:
-# kubectl create secret generic rapidapi-proxy-secret \
-#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
-#   -n holidays

flux/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - external-secrets
   - gitea-runner
   - monitoring
   - docs-site

flux/zip-enrichment/externalsecret.yaml

@@ -1,29 +1,18 @@
-# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+apiVersion: external-secrets.io/v1beta1
-# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+kind: ExternalSecret
-# the external-secrets operator are running in the cluster.
+metadata:
-#
+  name: rapidapi-proxy-secret
-# Example (uncomment and fill in secretStore name):
+  namespace: zip-enrichment
-#
+spec:
-# apiVersion: external-secrets.io/v1beta1
+  refreshInterval: 1h
-# kind: ExternalSecret
+  secretStoreRef:
-# metadata:
+    name: kubernetes-provider
-#   name: rapidapi-proxy-secret
+    kind: ClusterSecretStore
-#   namespace: zip-enrichment
+  target:
-# spec:
+    name: rapidapi-proxy-secret
-#   refreshInterval: 1h
+    creationPolicy: Owner
-#   secretStoreRef:
+  data:
-#     name: <your-secret-store>
+    - secretKey: X-RapidAPI-Proxy-Secret
-#     kind: ClusterSecretStore
+      remoteRef:
-#   target:
+        key: rapidapi-zip-enrichment-source
-#     name: rapidapi-proxy-secret
+        property: X-RapidAPI-Proxy-Secret
-#     creationPolicy: Owner
-#   data:
-#     - secretKey: X-RapidAPI-Proxy-Secret
-#       remoteRef:
-#         key: rapidapi/zip-enrichment
-#         property: proxy-secret
-#
-# Until then, create manually:
-# kubectl create secret generic rapidapi-proxy-secret \
-#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
-#   -n zip-enrichment