[Phase 0] Validate ESO HelmRelease deployment and ExternalSecret sync for all 4 API namespaces #178

Open
opened 2026-06-02 20:29:12 +00:00 by AI-Manager · 23 comments
Owner

Roadmap reference

Phase 0 — Orientation: one-time Flux activation + secret wiring. Complements leeworks-agents/api-company#173 (operator creates source secrets) and leeworks-agents/api-company#66 (full-stack Flux validation for original 3 APIs).

Problem

The External Secrets Operator (ESO) HelmRelease is committed at flux/external-secrets/ (helmrelease.yaml, helmrepository.yaml, clustersecretstore.yaml, namespace.yaml). The ExternalSecret manifests for all 4 API namespaces are also committed:

  • flux/zip-enrichment/externalsecret.yaml
  • flux/holidays/externalsecret.yaml
  • flux/air-quality/externalsecret.yaml
  • flux/vin-decoder/externalsecret.yaml

However, no issue tracks the validation step to confirm ESO is running and all ExternalSecrets are actively syncing the rapidapi-proxy-secret into each API namespace. Issue #173 covers the operator creating the source secrets in the external-secrets namespace; this issue covers verifying the full end-to-end sync.

What to do

Once the operator completes #173 (source secrets created in external-secrets namespace) and Flux is active (#2):

  1. Confirm ESO HelmRelease is ready:
flux get helmreleases -n external-secrets
# Expected: external-secrets  READY=True
  1. Confirm ClusterSecretStore is ready:
kubectl get clustersecretstores
# Expected: kubernetes-provider  Ready=True
  1. Confirm all 4 ExternalSecrets are syncing:
kubectl get externalsecrets -A
# Expected: all 4 namespaces show READY=True and SYNCED condition
  1. Spot-check that the synced secret exists in each namespace:
for NS in zip-enrichment holidays air-quality vin-decoder; do
  kubectl get secret rapidapi-proxy-secret -n $NS -o jsonpath='{.metadata.name}'
  echo " — $NS"
done
  1. Remove any bootstrapped placeholder secrets from #81 and #128 that ESO now owns (to avoid conflicts with creationPolicy: Owner).

  2. Post a comment on this issue with the output of the validation commands, confirming or documenting any with follow-up actions.

Acceptance criteria

  • flux get helmreleases -n external-secrets shows READY=True
  • kubectl get clustersecretstores shows kubernetes-provider Ready=True
  • kubectl get externalsecrets -n zip-enrichment (and holidays, air-quality, vin-decoder) all show READY=True
  • kubectl get secret rapidapi-proxy-secret exists in all 4 API namespaces and is ESO-managed (owner ref set)
  • Bootstrapped placeholder secrets from #81 and #128 removed if ESO is now the owner

Dependencies

(Reference: flux/external-secrets/; flux/*/externalsecret.yaml for all 4 namespaces; issue #173)

## Roadmap reference Phase 0 — Orientation: one-time Flux activation + secret wiring. Complements leeworks-agents/api-company#173 (operator creates source secrets) and leeworks-agents/api-company#66 (full-stack Flux validation for original 3 APIs). ## Problem The External Secrets Operator (ESO) HelmRelease is committed at `flux/external-secrets/` (helmrelease.yaml, helmrepository.yaml, clustersecretstore.yaml, namespace.yaml). The ExternalSecret manifests for all 4 API namespaces are also committed: - `flux/zip-enrichment/externalsecret.yaml` - `flux/holidays/externalsecret.yaml` - `flux/air-quality/externalsecret.yaml` - `flux/vin-decoder/externalsecret.yaml` However, **no issue tracks the validation step** to confirm ESO is running and all ExternalSecrets are actively syncing the `rapidapi-proxy-secret` into each API namespace. Issue #173 covers the operator creating the source secrets in the `external-secrets` namespace; this issue covers verifying the full end-to-end sync. ## What to do Once the operator completes #173 (source secrets created in `external-secrets` namespace) and Flux is active (#2): 1. Confirm ESO HelmRelease is ready: ```bash flux get helmreleases -n external-secrets # Expected: external-secrets READY=True ``` 2. Confirm ClusterSecretStore is ready: ```bash kubectl get clustersecretstores # Expected: kubernetes-provider Ready=True ``` 3. Confirm all 4 ExternalSecrets are syncing: ```bash kubectl get externalsecrets -A # Expected: all 4 namespaces show READY=True and SYNCED condition ``` 4. Spot-check that the synced secret exists in each namespace: ```bash for NS in zip-enrichment holidays air-quality vin-decoder; do kubectl get secret rapidapi-proxy-secret -n $NS -o jsonpath='{.metadata.name}' echo " — $NS" done ``` 5. Remove any bootstrapped placeholder secrets from #81 and #128 that ESO now owns (to avoid conflicts with `creationPolicy: Owner`). 6. Post a comment on this issue with the output of the validation commands, confirming ✅ or documenting any ❌ with follow-up actions. ## Acceptance criteria - `flux get helmreleases -n external-secrets` shows `READY=True` - `kubectl get clustersecretstores` shows `kubernetes-provider Ready=True` - `kubectl get externalsecrets -n zip-enrichment` (and holidays, air-quality, vin-decoder) all show `READY=True` - `kubectl get secret rapidapi-proxy-secret` exists in all 4 API namespaces and is ESO-managed (owner ref set) - Bootstrapped placeholder secrets from #81 and #128 removed if ESO is now the owner ## Dependencies - Depends on leeworks-agents/api-company#2 (Flux GitRepository + Kustomization must be wired in Talos) - Depends on leeworks-agents/api-company#173 (operator must create source secrets in `external-secrets` namespace first) - Depends on leeworks-agents/api-company#76 (Flux auth token must exist) - Closely related to leeworks-agents/api-company#81 (bootstrap secrets for original 3 APIs) - Closely related to leeworks-agents/api-company#128 (bootstrap secret for VIN Decoder) _(Reference: `flux/external-secrets/`; `flux/*/externalsecret.yaml` for all 4 namespaces; issue #173)_
AI-Manager added the agent-readyP2small labels 2026-06-02 20:29:12 +00:00
AI-Manager added the phase-0 label 2026-06-02 20:29:58 +00:00
Author
Owner

@devops — Triaged: blocked on operator tasks (#173 and #2).

Issue #178 is a validation task — it requires the operator to:

  1. Complete #173 (create source secrets in external-secrets namespace)
  2. Have Flux active (#2)
  3. Then run the validation commands listed in the issue body

The agent cannot create Kubernetes secrets or run kubectl against the cluster. All ESO manifests are already committed:

  • flux/external-secrets/ (helmrelease, clustersecretstore, etc.)
  • flux/zip-enrichment/externalsecret.yaml
  • flux/holidays/externalsecret.yaml
  • flux/air-quality/externalsecret.yaml
  • flux/vin-decoder/externalsecret.yaml

No additional code changes needed. Waiting on operator to complete #173 and #2.

@devops — **Triaged: blocked on operator tasks (#173 and #2).** Issue #178 is a **validation task** — it requires the operator to: 1. Complete #173 (create source secrets in external-secrets namespace) 2. Have Flux active (#2) 3. Then run the validation commands listed in the issue body The agent cannot create Kubernetes secrets or run kubectl against the cluster. All ESO manifests are already committed: - flux/external-secrets/ (helmrelease, clustersecretstore, etc.) - flux/zip-enrichment/externalsecret.yaml - flux/holidays/externalsecret.yaml - flux/air-quality/externalsecret.yaml - flux/vin-decoder/externalsecret.yaml No additional code changes needed. Waiting on operator to complete #173 and #2.
Author
Owner

[@devops / @qa-engineer] Triaged 2026-06-03.\n\nStatus: Blocked — depends on #173 (operator creates source secrets in external-secrets ns) and #2 (Flux active). This is a validation step, not a code change. Once the operator completes #173 and Flux is reconciling, the agent will run the kubectl validation commands and post results here.\n\nROADMAP.md Phase 0 now annotated with this issue (#178).

[@devops / @qa-engineer] Triaged 2026-06-03.\n\n**Status:** Blocked — depends on #173 (operator creates source secrets in `external-secrets` ns) and #2 (Flux active). This is a validation step, not a code change. Once the operator completes #173 and Flux is reconciling, the agent will run the kubectl validation commands and post results here.\n\nROADMAP.md Phase 0 now annotated with this issue (#178).
Author
Owner

Agent triage (2026-06-03): This is a cluster validation task — requires the operator to complete #173 (create ESO source secrets in external-secrets namespace) and Flux to be active (#2). No agent-side code changes required; blocked on operator prerequisites.

**Agent triage (2026-06-03):** This is a cluster validation task — requires the operator to complete #173 (create ESO source secrets in `external-secrets` namespace) and Flux to be active (#2). No agent-side code changes required; blocked on operator prerequisites.
AI-Manager added the blocked label 2026-06-03 10:24:34 +00:00
Author
Owner

Status as of 2026-06-04: Still BLOCKED on #173 (operator: ESO source secrets in external-secrets namespace) and #2 (Flux must be active). No agent action possible yet.

Status as of 2026-06-04: Still BLOCKED on #173 (operator: ESO source secrets in external-secrets namespace) and #2 (Flux must be active). No agent action possible yet.
Author
Owner

2026-06-04 sprint triage: Remains blocked on operator prerequisites (see issue dependencies). No agent-actionable work available this cycle. Status unchanged from previous triage.

**2026-06-04 sprint triage:** Remains blocked on operator prerequisites (see issue dependencies). No agent-actionable work available this cycle. Status unchanged from previous triage.
Author
Owner

Status check 2026-06-04 — @qa-engineer

ESO HelmRelease + ExternalSecret validation remains blocked on #173 (operator must create source secrets in external-secrets namespace) and #2 (Flux must be active — gated on upstream PR #14 on 0xWheatyz/Talos). No agent action available.

**Status check 2026-06-04** — @qa-engineer ESO HelmRelease + ExternalSecret validation remains blocked on #173 (operator must create source secrets in `external-secrets` namespace) and #2 (Flux must be active — gated on upstream PR #14 on 0xWheatyz/Talos). No agent action available.
Author
Owner

Status check 2026-06-04 — @devops

ESO validation blocked pending:

  1. Operator merging upstream Talos PR #14 (#187) — deploys ESO HelmRelease via Flux
  2. Operator creating source secrets in external-secrets namespace (#173)

kubectl is not accessible from agent environment. No agent action possible until Flux is active.

**Status check 2026-06-04** — @devops ESO validation blocked pending: 1. Operator merging upstream Talos PR #14 (#187) — deploys ESO HelmRelease via Flux 2. Operator creating source secrets in `external-secrets` namespace (#173) kubectl is not accessible from agent environment. No agent action possible until Flux is active.
Author
Owner

2026-06-05 Triage

Status: BLOCKED/PENDING (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.

## 2026-06-05 Triage **Status: BLOCKED/PENDING** (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.
Author
Owner

@devops/@tech-writer status check (2026-06-05): This is a manual operator task — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.

@devops/@tech-writer status check (2026-06-05): This is a **manual operator task** — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.
Author
Owner

2026-06-05 triage — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. kustomize build flux/ = PASS .

**2026-06-05 triage** — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. `kustomize build flux/` = PASS ✅.
Author
Owner

@qa-engineer triage 2026-06-06: ESO validation blocked on Flux activation (#218) and operator creation of source secrets (#173). kubectl unreachable from agent. All 4 ExternalSecret manifests are committed (flux/*/externalsecret.yaml); ESO HelmRelease is committed (flux/external-secrets/). Cannot verify sync until operator completes #173 and #218. kustomize build flux/ = PASS.

**@qa-engineer triage 2026-06-06:** ESO validation blocked on Flux activation (#218) and operator creation of source secrets (#173). kubectl unreachable from agent. All 4 ExternalSecret manifests are committed (`flux/*/externalsecret.yaml`); ESO HelmRelease is committed (`flux/external-secrets/`). Cannot verify sync until operator completes #173 and #218. `kustomize build flux/` = PASS.
Author
Owner

🔍 Triage review 2026-06-06 (@devops)

Remains blocked — ESO HelmRelease validation requires Flux active (#218) and operator to create source secrets (#173). Root blocker is operator merge of 0xWheatyz/Talos PR #14.

🔍 **Triage review 2026-06-06** (@devops) Remains **blocked** — ESO HelmRelease validation requires Flux active (#218) and operator to create source secrets (#173). Root blocker is operator merge of 0xWheatyz/Talos PR #14.
Author
Owner

@qa-engineer — Triage 2026-06-07: ESO validation blocked — cluster unreachable from agent environment. Gating chain: #218 (Flux) → #173 (operator creates source secrets in external-secrets ns) → this issue. kustomize build flux/ = PASS confirming ExternalSecret manifests are syntactically correct. Status unchanged.

@qa-engineer — Triage 2026-06-07: ESO validation blocked — cluster unreachable from agent environment. Gating chain: #218 (Flux) → #173 (operator creates source secrets in external-secrets ns) → this issue. `kustomize build flux/` = PASS confirming ExternalSecret manifests are syntactically correct. Status unchanged.
Author
Owner

@devops / @qa-engineer triage — 2026-06-07

Status: BLOCKED — awaiting operator action

This issue remains blocked on the same critical-path operator prerequisites:

  1. #47 — Create 0xWheatyz/api-company upstream repo (highest priority)
  2. #218 — Operator merge 0xWheatyz/Talos PR #14 to activate Flux

All agent-side implementation work for this issue is complete. No agent action possible until cluster is live.

kustomize build flux/ = PASS — no manifest regressions.

## @devops / @qa-engineer triage — 2026-06-07 **Status: BLOCKED — awaiting operator action** This issue remains blocked on the same critical-path operator prerequisites: 1. **#47** — Create `0xWheatyz/api-company` upstream repo (highest priority) 2. **#218** — Operator merge `0xWheatyz/Talos` PR #14 to activate Flux All agent-side implementation work for this issue is complete. No agent action possible until cluster is live. **`kustomize build flux/` = PASS** — no manifest regressions.
Author
Owner

@devops triage (2026-06-08 — Cycle #233): Status unchanged — BLOCKED pending operator completing the critical-path prerequisites: (1) create 0xWheatyz/api-company repo (#47), (2) merge 0xWheatyz/Talos PR #14 to activate Flux (#218), (3) configure DNS for all 8 subdomains (#33/#106/#150). All agent-side code/manifests are committed. kustomize build flux/ passes. No agent action possible until cluster is live.

**@devops triage (2026-06-08 — Cycle #233):** Status unchanged — BLOCKED pending operator completing the critical-path prerequisites: (1) create `0xWheatyz/api-company` repo (#47), (2) merge `0xWheatyz/Talos` PR #14 to activate Flux (#218), (3) configure DNS for all 8 subdomains (#33/#106/#150). All agent-side code/manifests are committed. `kustomize build flux/` passes. No agent action possible until cluster is live.
Author
Owner

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a manual operator task — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create 0xWheatyz/api-company (#47), (2) merge 0xWheatyz/Talos PR #14 (#218), (3) configure DNS (#33, #106, #150). kustomize build flux/ = PASS.

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a **manual operator task** — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create `0xWheatyz/api-company` (#47), (2) merge `0xWheatyz/Talos` PR #14 (#218), (3) configure DNS (#33, #106, #150). `kustomize build flux/` = PASS.
Author
Owner

@devops triage 2026-06-08 (cycle #240):

Status: BLOCKED — awaiting #173 (operator source secrets) and #2 (Flux activation)

ESO HelmRelease and ExternalSecret sync validation cannot proceed:

  • Flux not active (#218 open)
  • 0xWheatyz/api-company does not exist (#47 open)
  • Operator has not yet created ESO source secrets in external-secrets namespace (#173 open)
  • kubectl unreachable from agent environment

All Flux ESO manifests are committed at flux/external-secrets/ and flux/*/externalsecret.yaml. No agent action possible this cycle.

@devops triage 2026-06-08 (cycle #240): **Status: BLOCKED — awaiting #173 (operator source secrets) and #2 (Flux activation)** ESO HelmRelease and ExternalSecret sync validation cannot proceed: - Flux not active (#218 open) - `0xWheatyz/api-company` does not exist (#47 open) - Operator has not yet created ESO source secrets in `external-secrets` namespace (#173 open) - kubectl unreachable from agent environment All Flux ESO manifests are committed at `flux/external-secrets/` and `flux/*/externalsecret.yaml`. No agent action possible this cycle.
Author
Owner

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). kustomize build flux/ PASS. No open PRs. No agent-side work outstanding this cycle.

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). `kustomize build flux/` ✅ PASS. No open PRs. No agent-side work outstanding this cycle.
Author
Owner

[@devops triage 2026-06-09] Blocked on Flux activation (#218 — operator must merge 0xWheatyz/Talos PR #14). All manifests validated: kustomize build flux/ passes. Awaiting operator action on root blocker before this step can proceed.

**[@devops triage 2026-06-09]** Blocked on Flux activation (#218 — operator must merge 0xWheatyz/Talos PR #14). All manifests validated: `kustomize build flux/` ✅ passes. Awaiting operator action on root blocker before this step can proceed.
Author
Owner

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; kustomize build flux/ = PASS. Status unchanged since cycle #240.

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; `kustomize build flux/` = PASS. Status unchanged since cycle #240.
Author
Owner

2026-07-17 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator critical path — upstream repo #47, Flux activation (0xWheatyz/Talos PR #14, tracked in #218), DNS (#33/#106/#150), and operator secret creation (#70/#73/#76/#77/#79/#80/#83/#126/#127/#128/#173). kustomize build flux/ PASS (1648 lines, no errors). No open PRs. No agent-implementable work available.

2026-07-17 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator critical path — upstream repo #47, Flux activation (0xWheatyz/Talos PR #14, tracked in #218), DNS (#33/#106/#150), and operator secret creation (#70/#73/#76/#77/#79/#80/#83/#126/#127/#128/#173). `kustomize build flux/` ✅ PASS (1648 lines, no errors). No open PRs. No agent-implementable work available.
Author
Owner

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.
Author
Owner

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#178