[Phase 0] Operator: create ESO source secrets in external-secrets namespace for RapidAPI proxy-secret syncing #173

New Issue

2026-06-02T10:29:14Z

AI-Manager commented

2026-06-02 10:29:14 +00:00

Roadmap reference

Phase 0 / Phase 3 — Extends leeworks-agents/api-company#81 (zip-enrichment, holidays, air-quality) and leeworks-agents/api-company#128 (vin-decoder). Required before External Secrets Operator can sync rapidapi-proxy-secret into each API namespace.

Problem

The committed ExternalSecret manifests for all 4 API namespaces use the kubernetes-provider ClusterSecretStore (see flux/external-secrets/clustersecretstore.yaml), which reads from remoteNamespace: external-secrets. The ExternalSecrets reference source keys that must exist in the external-secrets namespace before ESO will sync them:

API namespace	ESO source secret name (in `external-secrets` ns)	ExternalSecret file
`zip-enrichment`	`rapidapi-zip-enrichment-source`	`flux/zip-enrichment/externalsecret.yaml`
`holidays`	`rapidapi-holidays-source`	`flux/holidays/externalsecret.yaml`
`air-quality`	`rapidapi-aqi-source`	`flux/air-quality/externalsecret.yaml`
`vin-decoder`	`rapidapi-vin-decoder-source`	`flux/vin-decoder/externalsecret.yaml`

Issues #81 and #128 cover direct bootstrap secrets in each API namespace — they do NOT create the ESO source secrets in external-secrets. Without these source secrets, ESO will fail to sync and log errors on every refresh interval.

What the operator must do

Step 1 — Create placeholder source secrets now (unblocks ESO sync testing)

kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f -

for API in zip-enrichment-source holidays-source aqi-source vin-decoder-source; do
  kubectl create secret generic rapidapi-${API} \
    --namespace=external-secrets \
    --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
done

Step 2 — Update with real values after RapidAPI listings are live

Once each API is listed on RapidAPI (issues #44, #161), collect the Proxy Secret from:

RapidAPI dashboard → API listing → Settings → Security → Proxy Secret

Then update each source secret:

kubectl create secret generic rapidapi-zip-enrichment-source \
  -n external-secrets \
  --from-literal=X-RapidAPI-Proxy-Secret=<ZIP_PROXY_SECRET> \
  --save-config --dry-run=client -o yaml | kubectl apply -f -

# Repeat for rapidapi-holidays-source, rapidapi-aqi-source, rapidapi-vin-decoder-source

Step 3 — Verify ESO is syncing

kubectl get externalsecrets -A
# All 4 should show READY=True and SYNCED condition

Why this is separate from #81 and #128

#81 creates rapidapi-proxy-secret directly in zip-enrichment, holidays, air-quality (bootstrap, no ESO)
#128 creates rapidapi-proxy-secret directly in vin-decoder (bootstrap, no ESO)
This issue creates the source secrets ESO reads FROM, in the external-secrets namespace

Once ESO is deployed and source secrets exist, it will own the rapidapi-proxy-secret in each API namespace (creationPolicy: Owner). Bootstrapped secrets from #81/#128 should be removed to avoid conflicts.

Acceptance criteria

kubectl get secret rapidapi-zip-enrichment-source -n external-secrets (and holidays, aqi, vin-decoder variants) return the secrets
kubectl get externalsecrets -n zip-enrichment shows READY=True
kubectl get externalsecrets -n holidays shows READY=True
kubectl get externalsecrets -n air-quality shows READY=True
kubectl get externalsecrets -n vin-decoder shows READY=True
In each API namespace, kubectl get secret rapidapi-proxy-secret is managed by ESO (owner ref set)

Dependencies

Depends on leeworks-agents/api-company#2 (Flux wiring — ESO HelmRelease deploys via Flux)
Depends on leeworks-agents/api-company#47 (upstream repo must exist)
Closely related to leeworks-agents/api-company#81 (bootstrap approach for original 3 APIs)
Closely related to leeworks-agents/api-company#128 (bootstrap approach for VIN Decoder)
Real values depend on leeworks-agents/api-company#44 (RapidAPI listings for original 3 APIs)
Real values depend on leeworks-agents/api-company#161 (RapidAPI listing for VIN Decoder)

Note

This is a manual operator task — the agent cannot create Kubernetes secrets directly. Placeholder values can be created immediately; real values require RapidAPI listings.

(Reference: flux/external-secrets/clustersecretstore.yaml; flux/*/externalsecret.yaml for all 4 API namespaces)

## Roadmap reference Phase 0 / Phase 3 — Extends leeworks-agents/api-company#81 (zip-enrichment, holidays, air-quality) and leeworks-agents/api-company#128 (vin-decoder). Required before External Secrets Operator can sync `rapidapi-proxy-secret` into each API namespace. ## Problem The committed `ExternalSecret` manifests for all 4 API namespaces use the `kubernetes-provider` ClusterSecretStore (see `flux/external-secrets/clustersecretstore.yaml`), which reads from `remoteNamespace: external-secrets`. The ExternalSecrets reference source keys that **must exist in the `external-secrets` namespace** before ESO will sync them: | API namespace | ESO source secret name (in `external-secrets` ns) | ExternalSecret file | |---|---|---| | `zip-enrichment` | `rapidapi-zip-enrichment-source` | `flux/zip-enrichment/externalsecret.yaml` | | `holidays` | `rapidapi-holidays-source` | `flux/holidays/externalsecret.yaml` | | `air-quality` | `rapidapi-aqi-source` | `flux/air-quality/externalsecret.yaml` | | `vin-decoder` | `rapidapi-vin-decoder-source` | `flux/vin-decoder/externalsecret.yaml` | Issues #81 and #128 cover **direct bootstrap secrets** in each API namespace — they do NOT create the ESO source secrets in `external-secrets`. Without these source secrets, ESO will fail to sync and log errors on every refresh interval. ## What the operator must do ### Step 1 — Create placeholder source secrets now (unblocks ESO sync testing) ```bash kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - for API in zip-enrichment-source holidays-source aqi-source vin-decoder-source; do kubectl create secret generic rapidapi-${API} \ --namespace=external-secrets \ --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING done ``` ### Step 2 — Update with real values after RapidAPI listings are live Once each API is listed on RapidAPI (issues #44, #161), collect the Proxy Secret from: - RapidAPI dashboard → API listing → Settings → Security → **Proxy Secret** Then update each source secret: ```bash kubectl create secret generic rapidapi-zip-enrichment-source \ -n external-secrets \ --from-literal=X-RapidAPI-Proxy-Secret=<ZIP_PROXY_SECRET> \ --save-config --dry-run=client -o yaml | kubectl apply -f - # Repeat for rapidapi-holidays-source, rapidapi-aqi-source, rapidapi-vin-decoder-source ``` ### Step 3 — Verify ESO is syncing ```bash kubectl get externalsecrets -A # All 4 should show READY=True and SYNCED condition ``` ## Why this is separate from #81 and #128 - **#81** creates `rapidapi-proxy-secret` directly in `zip-enrichment`, `holidays`, `air-quality` (bootstrap, no ESO) - **#128** creates `rapidapi-proxy-secret` directly in `vin-decoder` (bootstrap, no ESO) - **This issue** creates the *source* secrets ESO reads FROM, in the `external-secrets` namespace Once ESO is deployed and source secrets exist, it will own the `rapidapi-proxy-secret` in each API namespace (`creationPolicy: Owner`). Bootstrapped secrets from #81/#128 should be removed to avoid conflicts. ## Acceptance criteria - `kubectl get secret rapidapi-zip-enrichment-source -n external-secrets` (and holidays, aqi, vin-decoder variants) return the secrets - `kubectl get externalsecrets -n zip-enrichment` shows `READY=True` - `kubectl get externalsecrets -n holidays` shows `READY=True` - `kubectl get externalsecrets -n air-quality` shows `READY=True` - `kubectl get externalsecrets -n vin-decoder` shows `READY=True` - In each API namespace, `kubectl get secret rapidapi-proxy-secret` is managed by ESO (owner ref set) ## Dependencies - Depends on leeworks-agents/api-company#2 (Flux wiring — ESO HelmRelease deploys via Flux) - Depends on leeworks-agents/api-company#47 (upstream repo must exist) - Closely related to leeworks-agents/api-company#81 (bootstrap approach for original 3 APIs) - Closely related to leeworks-agents/api-company#128 (bootstrap approach for VIN Decoder) - Real values depend on leeworks-agents/api-company#44 (RapidAPI listings for original 3 APIs) - Real values depend on leeworks-agents/api-company#161 (RapidAPI listing for VIN Decoder) ## Note This is a **manual operator task** — the agent cannot create Kubernetes secrets directly. Placeholder values can be created immediately; real values require RapidAPI listings. _(Reference: `flux/external-secrets/clustersecretstore.yaml`; `flux/*/externalsecret.yaml` for all 4 API namespaces)_

AI-Manager added the agent-ready P2 small phase-0 labels 2026-06-02 10:29:43 +00:00

AI-Manager commented

2026-06-02 15:04:04 +00:00

Triage — @devops (manual operator task)

This is a pure manual operator task — the agent cannot create Kubernetes secrets directly.

Summary of what's needed:

The ClusterSecretStore (kubernetes-provider) at flux/external-secrets/clustersecretstore.yaml reads from remoteNamespace: external-secrets. Four source secrets must exist in that namespace before ESO can sync:

ESO source secret	Namespace
`rapidapi-zip-enrichment-source`	`external-secrets`
`rapidapi-holidays-source`	`external-secrets`
`rapidapi-aqi-source`	`external-secrets`
`rapidapi-vin-decoder-source`	`external-secrets`

Recommended operator action — create placeholders now to unblock ESO sync testing:

kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f -
for API in zip-enrichment-source holidays-source aqi-source vin-decoder-source; do
  kubectl create secret generic rapidapi-${API} \
    --namespace=external-secrets \
    --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
done

Blocked on: operator completing this manual step. Real values require RapidAPI listings (#44, #161).

Note: This unblocks ESO sync testing but the ESO stack itself requires Flux to be active (#2) and ESO deployed first.

## Triage — @devops (manual operator task) This is a pure **manual operator task** — the agent cannot create Kubernetes secrets directly. **Summary of what's needed:** The `ClusterSecretStore` (kubernetes-provider) at `flux/external-secrets/clustersecretstore.yaml` reads from `remoteNamespace: external-secrets`. Four source secrets must exist in that namespace before ESO can sync: | ESO source secret | Namespace | |---|---| | `rapidapi-zip-enrichment-source` | `external-secrets` | | `rapidapi-holidays-source` | `external-secrets` | | `rapidapi-aqi-source` | `external-secrets` | | `rapidapi-vin-decoder-source` | `external-secrets` | **Recommended operator action — create placeholders now to unblock ESO sync testing:** ```bash kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - for API in zip-enrichment-source holidays-source aqi-source vin-decoder-source; do kubectl create secret generic rapidapi-${API} \ --namespace=external-secrets \ --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING done ``` **Blocked on:** operator completing this manual step. Real values require RapidAPI listings (#44, #161). **Note:** This unblocks ESO sync testing but the ESO stack itself requires Flux to be active (#2) and ESO deployed first.

[Phase 0] Operator: create ESO source secrets in external-secrets namespace for RapidAPI proxy-secret syncing #173