From 43f5d5ef60eb5df658af49c621b8f3db7ede76e8 Mon Sep 17 00:00:00 2001 From: agent-company Date: Wed, 27 May 2026 15:05:54 +0000 Subject: [PATCH] feat: deploy External Secrets Operator (ESO) via Flux + real ExternalSecrets Add flux/external-secrets/ directory containing: - namespace.yaml: external-secrets namespace - helmrepository.yaml: charts.external-secrets.io HelmRepository - helmrelease.yaml: ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0) - clustersecretstore.yaml: ClusterSecretStore using Kubernetes provider (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore) - kustomization.yaml: wires all above resources Uncomment and complete ExternalSecret manifests in each API namespace: - flux/zip-enrichment/externalsecret.yaml - flux/holidays/externalsecret.yaml - flux/air-quality/externalsecret.yaml All three ExternalSecrets reference the kubernetes-provider ClusterSecretStore and will auto-sync rapidapi-proxy-secret once ESO is running. Add external-secrets to flux/kustomization.yaml. kustomize build flux/ = PASS Closes leeworks-agents/api-company#61 --- flux/air-quality/externalsecret.yaml | 47 +++++++---------- flux/external-secrets/clustersecretstore.yaml | 50 +++++++++++++++++++ flux/external-secrets/helmrelease.yaml | 30 +++++++++++ flux/external-secrets/helmrepository.yaml | 8 +++ flux/external-secrets/kustomization.yaml | 7 +++ flux/external-secrets/namespace.yaml | 4 ++ flux/holidays/externalsecret.yaml | 47 +++++++---------- flux/kustomization.yaml | 1 + flux/zip-enrichment/externalsecret.yaml | 47 +++++++---------- 9 files changed, 154 insertions(+), 87 deletions(-) create mode 100644 flux/external-secrets/clustersecretstore.yaml create mode 100644 flux/external-secrets/helmrelease.yaml create mode 100644 flux/external-secrets/helmrepository.yaml create mode 100644 flux/external-secrets/kustomization.yaml create mode 100644 flux/external-secrets/namespace.yaml diff --git a/flux/air-quality/externalsecret.yaml b/flux/air-quality/externalsecret.yaml index 33c66e2..373fa33 100644 --- a/flux/air-quality/externalsecret.yaml +++ b/flux/air-quality/externalsecret.yaml @@ -1,29 +1,18 @@ -# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed. -# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and -# the external-secrets operator are running in the cluster. -# -# Example (uncomment and fill in secretStore name): -# -# apiVersion: external-secrets.io/v1beta1 -# kind: ExternalSecret -# metadata: -# name: rapidapi-proxy-secret -# namespace: air-quality -# spec: -# refreshInterval: 1h -# secretStoreRef: -# name: -# kind: ClusterSecretStore -# target: -# name: rapidapi-proxy-secret -# creationPolicy: Owner -# data: -# - secretKey: X-RapidAPI-Proxy-Secret -# remoteRef: -# key: rapidapi/air-quality -# property: proxy-secret -# -# Until then, create manually: -# kubectl create secret generic rapidapi-proxy-secret \ -# --from-literal=X-RapidAPI-Proxy-Secret= \ -# -n air-quality +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: rapidapi-proxy-secret + namespace: air-quality +spec: + refreshInterval: 1h + secretStoreRef: + name: kubernetes-provider + kind: ClusterSecretStore + target: + name: rapidapi-proxy-secret + creationPolicy: Owner + data: + - secretKey: X-RapidAPI-Proxy-Secret + remoteRef: + key: rapidapi-air-quality-source + property: X-RapidAPI-Proxy-Secret diff --git a/flux/external-secrets/clustersecretstore.yaml b/flux/external-secrets/clustersecretstore.yaml new file mode 100644 index 0000000..ba377f2 --- /dev/null +++ b/flux/external-secrets/clustersecretstore.yaml @@ -0,0 +1,50 @@ +# ClusterSecretStore using the Kubernetes provider. +# Reads secrets from the cluster itself — no external vault required. +# The service account below must have get/list access to secrets in +# the namespaces where ExternalSecrets are created. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-kubernetes-provider + namespace: external-secrets +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: eso-kubernetes-provider-reader +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eso-kubernetes-provider-reader +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: eso-kubernetes-provider-reader +subjects: + - kind: ServiceAccount + name: eso-kubernetes-provider + namespace: external-secrets +--- +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: kubernetes-provider +spec: + provider: + kubernetes: + remoteNamespace: external-secrets + server: + caProvider: + type: ConfigMap + name: kube-root-ca.crt + namespace: external-secrets + key: ca.crt + auth: + serviceAccount: + name: eso-kubernetes-provider + namespace: external-secrets diff --git a/flux/external-secrets/helmrelease.yaml b/flux/external-secrets/helmrelease.yaml new file mode 100644 index 0000000..4617a6b --- /dev/null +++ b/flux/external-secrets/helmrelease.yaml @@ -0,0 +1,30 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: 15m + chart: + spec: + chart: external-secrets + version: ">=0.9.0 <1.0.0" + sourceRef: + kind: HelmRepository + name: external-secrets + namespace: flux-system + interval: 60m + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: + installCRDs: true + webhook: + port: 9443 + certController: + requeueInterval: 5m diff --git a/flux/external-secrets/helmrepository.yaml b/flux/external-secrets/helmrepository.yaml new file mode 100644 index 0000000..bf74fd5 --- /dev/null +++ b/flux/external-secrets/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: external-secrets + namespace: flux-system +spec: + interval: 60m + url: https://charts.external-secrets.io diff --git a/flux/external-secrets/kustomization.yaml b/flux/external-secrets/kustomization.yaml new file mode 100644 index 0000000..98d490e --- /dev/null +++ b/flux/external-secrets/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helmrepository.yaml + - helmrelease.yaml + - clustersecretstore.yaml diff --git a/flux/external-secrets/namespace.yaml b/flux/external-secrets/namespace.yaml new file mode 100644 index 0000000..4ef398e --- /dev/null +++ b/flux/external-secrets/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets diff --git a/flux/holidays/externalsecret.yaml b/flux/holidays/externalsecret.yaml index 469880e..7b65ce0 100644 --- a/flux/holidays/externalsecret.yaml +++ b/flux/holidays/externalsecret.yaml @@ -1,29 +1,18 @@ -# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed. -# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and -# the external-secrets operator are running in the cluster. -# -# Example (uncomment and fill in secretStore name): -# -# apiVersion: external-secrets.io/v1beta1 -# kind: ExternalSecret -# metadata: -# name: rapidapi-proxy-secret -# namespace: holidays -# spec: -# refreshInterval: 1h -# secretStoreRef: -# name: -# kind: ClusterSecretStore -# target: -# name: rapidapi-proxy-secret -# creationPolicy: Owner -# data: -# - secretKey: X-RapidAPI-Proxy-Secret -# remoteRef: -# key: rapidapi/holidays -# property: proxy-secret -# -# Until then, create manually: -# kubectl create secret generic rapidapi-proxy-secret \ -# --from-literal=X-RapidAPI-Proxy-Secret= \ -# -n holidays +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: rapidapi-proxy-secret + namespace: holidays +spec: + refreshInterval: 1h + secretStoreRef: + name: kubernetes-provider + kind: ClusterSecretStore + target: + name: rapidapi-proxy-secret + creationPolicy: Owner + data: + - secretKey: X-RapidAPI-Proxy-Secret + remoteRef: + key: rapidapi-holidays-source + property: X-RapidAPI-Proxy-Secret diff --git a/flux/kustomization.yaml b/flux/kustomization.yaml index cef3caf..fed86ac 100644 --- a/flux/kustomization.yaml +++ b/flux/kustomization.yaml @@ -1,6 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - external-secrets - gitea-runner - monitoring - docs-site diff --git a/flux/zip-enrichment/externalsecret.yaml b/flux/zip-enrichment/externalsecret.yaml index fcd86a3..76d5579 100644 --- a/flux/zip-enrichment/externalsecret.yaml +++ b/flux/zip-enrichment/externalsecret.yaml @@ -1,29 +1,18 @@ -# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed. -# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and -# the external-secrets operator are running in the cluster. -# -# Example (uncomment and fill in secretStore name): -# -# apiVersion: external-secrets.io/v1beta1 -# kind: ExternalSecret -# metadata: -# name: rapidapi-proxy-secret -# namespace: zip-enrichment -# spec: -# refreshInterval: 1h -# secretStoreRef: -# name: -# kind: ClusterSecretStore -# target: -# name: rapidapi-proxy-secret -# creationPolicy: Owner -# data: -# - secretKey: X-RapidAPI-Proxy-Secret -# remoteRef: -# key: rapidapi/zip-enrichment -# property: proxy-secret -# -# Until then, create manually: -# kubectl create secret generic rapidapi-proxy-secret \ -# --from-literal=X-RapidAPI-Proxy-Secret= \ -# -n zip-enrichment +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: rapidapi-proxy-secret + namespace: zip-enrichment +spec: + refreshInterval: 1h + secretStoreRef: + name: kubernetes-provider + kind: ClusterSecretStore + target: + name: rapidapi-proxy-secret + creationPolicy: Owner + data: + - secretKey: X-RapidAPI-Proxy-Secret + remoteRef: + key: rapidapi-zip-enrichment-source + property: X-RapidAPI-Proxy-Secret